diff --git a/ansible/host_vars/prod-01.alexpires.me.yml b/ansible/host_vars/prod-01.alexpires.me.yml
index 7c1f415..484e353 100644
--- a/ansible/host_vars/prod-01.alexpires.me.yml
+++ b/ansible/host_vars/prod-01.alexpires.me.yml
@@ -93,6 +93,14 @@ fail2ban_jails:
     maxretry: 5
     findtime: 600
     bantime: 3600
+  postfix:
+    enabled: true
+    port: "smtp,ssmtp"
+    filter: "postfix"
+    logpath: "/var/log/postfix/current"
+    maxretry: 3
+    findtime: 600
+    bantime: 3600
 
 # aide
 install_aide: true
diff --git a/terraform/k8sapps/mail.tf b/terraform/k8sapps/mail.tf
index 56dd7ce..23d8697 100644
--- a/terraform/k8sapps/mail.tf
+++ b/terraform/k8sapps/mail.tf
@@ -53,7 +53,7 @@ locals {
     DOVECOT_AUTH_PORT    = 31000
     DOVECOT_LMTP_ADDRESS = "dovecot-lmtp.mail.svc.cluster.local"
     DOVECOT_LMTP_PORT    = 31024
-    LOG_TO_STDOUT        = 1
+    LOG_TO_STDOUT        = 0
   }
 
   password_hashes = {
@@ -435,7 +435,6 @@ resource "kubernetes_deployment" "dovecot" {
     ignore_changes = [spec[0].template[0].metadata[0].annotations]
     replace_triggered_by = [
       kubernetes_config_map.dovecot_config,
-      # kubernetes_secret.dovecot_users,
       kubernetes_config_map.dovecot_sieve,
     ]
   }
@@ -515,6 +514,11 @@ resource "kubernetes_deployment" "postfix" {
             mount_path = "/etc/letsencrypt"
             read_only  = true
           }
+          volume_mount {
+            name       = "postfix-logs"
+            mount_path = "/var/log/postfix"
+            read_only  = false
+          }
         }
         volume {
           name = "email-storage"
@@ -540,6 +544,12 @@ resource "kubernetes_deployment" "postfix" {
             secret_name = "mail-tls"
           }
         }
+        volume {
+          name = "postfix-logs"
+          host_path {
+            path = "/var/log/postfix"
+          }
+        }
       }
     }
   }