anchor.diff:          default = "${pkgs.cacert}/etc/ssl/certs/ca-bundle.crt";
           description = ''
             File containing trusted certification authorities (CA) to verify certificates of mailservers contacted for mail delivery. This basically sets smtp_tls_CAfile and enables opportunistic tls. Defaults to NixOS trusted certification authorities.
  -        '';
  -      };
  -
  -      useDane = mkOption {
  -        type = types.bool;
  -        default = false;
  -        description = ''
  -          Sets smtp_tls_security_level to "dane" rather than "may". See postconf(5) for details.
           '';
         };
   
  
positive.code:       (map (s: "reject_rbl_client " + s) cfg.dnsBlacklists);
  
    clientRestrictions = concatStringsSep ", " (clientAccess ++ dnsBl);
  
    smtpTlsSecurityLevel = if cfg.useDane then "dane" else mkDefault "may";
  
    mainCf = let
      escape = replaceStrings ["$"] ["$$"];
  
negative.code:   imports = [
     (mkRemovedOptionModule [ "services" "postfix" "sslCACert" ]
       "services.postfix.sslCACert was replaced by services.postfix.tlsTrustedAuthorities. In case you intend that your server should validate requested client certificates use services.postfix.extraConfig.")
  
     (mkChangedOptionModule [ "services" "postfix" "useDane" ]
       [ "services" "postfix" "config" "smtp_tls_security_level" ]
       (config: mkIf config.services.postfix.useDane "dane"))
    ];
  }
  