diff --git a/config/postfix-main.cf b/config/postfix-main.cf
new file mode 100644
index 0000000..33545e2
--- /dev/null
+++ b/config/postfix-main.cf
@@ -0,0 +1,24 @@
+# Postfix rate-limits + postscreen tarpit (E2 D3, soft mode, no DNSBL).
+# NOTE: smtpd_client_error_rate_limit / smtpd_slow_connection_rate_limit do not
+# exist in Postfix; mapped to the real anvil params smtpd_client_recipient_rate_limit
+# and smtpd_client_auth_rate_limit (same values).
+smtpd_client_connection_rate_limit = 10
+smtpd_client_message_rate_limit = 20
+smtpd_client_recipient_rate_limit = 10
+smtpd_client_auth_rate_limit = 5
+smtpd_hard_error_limit = 20
+smtpd_soft_error_limit = 10
+smtpd_error_sleep_time = 1s
+smtpd_junk_command_limit = 2
+postscreen_greet_action = enforce
+postscreen_bare_newline_enable = yes
+
+# Only $mydomain (produktor.io) is a LOCAL virtual mailbox domain (inbound).
+# Historical / incubator addresses (gmail.com, gmx.de, gridfactor.de, rpf.de,
+# viscreation.de, wheregroup.com) keep their Dovecot accounts for IMAP +
+# doveadm import, but must NOT be local delivery domains: otherwise outbound
+# mail to those domains short-circuits into the incubator archive (dovecot
+# lmtp "Saved") and never leaves the host — e.g. a campaign test from
+# info@produktor.io to eslider@gmail.com. Overridden last (DMS appends
+# postfix-main.cf after its own setup). See mailing skill, Gitea #115.
+virtual_mailbox_domains = $mydomain