anchor.diff:        (map (s: "reject_rbl_client " + s) cfg.dnsBlacklists);
   
     clientRestrictions = concatStringsSep ", " (clientAccess ++ dnsBl);
  -
  -  smtpTlsSecurityLevel = if cfg.useDane then "dane" else mkDefault "may";
   
     mainCf = let
       escape = replaceStrings ["$"] ["$$"];
  
positive.code:   imports = [
     (mkRemovedOptionModule [ "services" "postfix" "sslCACert" ]
       "services.postfix.sslCACert was replaced by services.postfix.tlsTrustedAuthorities. In case you intend that your server should validate requested client certificates use services.postfix.extraConfig.")
    ];
  }
  
negative.code:         default = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
          description = ''
            File containing trusted certification authorities (CA) to verify certificates of mailservers contacted for mail delivery. This basically sets smtp_tls_CAfile and enables opportunistic tls. Defaults to NixOS trusted certification authorities.
          '';
        };
  
  