diff --git a/roles/mail/templates/mailman/mailman.cfg.j2 b/roles/mail/templates/mailman/mailman.cfg.j2
index 39e864d..7e007f1 100644
--- a/roles/mail/templates/mailman/mailman.cfg.j2
+++ b/roles/mail/templates/mailman/mailman.cfg.j2
@@ -57,6 +57,8 @@ admin_user: restadmin
 admin_pass: {{ mailman3_restadminpass }}
 
 [mta]
+remove_dkim_headers: yes
+dmarc_mitigate_action: wrap_message
 incoming: mailman.mta.postfix.LMTP
 outgoing: mailman.mta.deliver.deliver
 smtp_host: localhost
diff --git a/roles/mail/templates/rspamd/local.d/arc.conf.j2 b/roles/mail/templates/rspamd/local.d/arc.conf.j2
index 1cb5120..a96246a 100644
--- a/roles/mail/templates/rspamd/local.d/arc.conf.j2
+++ b/roles/mail/templates/rspamd/local.d/arc.conf.j2
@@ -3,5 +3,7 @@ sign_networks = [127.0.0.1, ::1, {{ mail_trusted | join(", ") }}];
 check_pubkey = true;
 try_fallback = false;
 use_esld = false;
+allow_hdrfrom_mismatch = true;
+use_domain = "envelope";
 path = "/var/lib/rspamd/dkim/$domain.$selector.key";
 selector_map = "/etc/rspamd/local.d/arc_selectors.map";
diff --git a/roles/mail/templates/rspamd/local.d/dkim_signing.conf.j2 b/roles/mail/templates/rspamd/local.d/dkim_signing.conf.j2
index 8b8653e..5623c3f 100644
--- a/roles/mail/templates/rspamd/local.d/dkim_signing.conf.j2
+++ b/roles/mail/templates/rspamd/local.d/dkim_signing.conf.j2
@@ -3,5 +3,7 @@ sign_networks = [127.0.0.1, ::1, {{ mail_trusted | join(", ") }}];
 check_pubkey = true;
 try_fallback = false;
 use_esld = false;
+allow_hdrfrom_mismatch = true;
+use_domain = "envelope";
 path = "/var/lib/rspamd/dkim/$domain.$selector.key";
 selector_map = "/etc/rspamd/local.d/dkim_selectors.map";