diff --git a/nix-system-configs/modules/system/mail-server.nix b/nix-system-configs/modules/system/mail-server.nix
index 0b18ed0..b482176 100644
--- a/nix-system-configs/modules/system/mail-server.nix
+++ b/nix-system-configs/modules/system/mail-server.nix
@@ -120,7 +120,7 @@ in {
             challenge = "dns-01";
            # reference the contact and secret via files under /etc/stalwart
             contact = "%{file:/etc/stalwart/cloudflare-username}%";
-           domains = ["prg-radio.org" "mail.prg-radio.org"];
+           domains = ["prg-radio.org" "mailadmin.prg-radio.org" "mail.prg-radio.org"];
            provider = "cloudflare";
            secret = "%{file:/etc/stalwart/acme-secret}%";
         };
@@ -154,5 +154,12 @@ in {
         };
       };
     };
+
+        networking.firewall.allowedTCPPorts = [
+            25
+        ];
+        networking.firewall.allowedUDPPorts = [
+            25
+        ];
   };
 }
diff --git a/nix-system-configs/modules/system/traefik.nix b/nix-system-configs/modules/system/traefik.nix
index 5c20f91..6c50686 100644
--- a/nix-system-configs/modules/system/traefik.nix
+++ b/nix-system-configs/modules/system/traefik.nix
@@ -379,7 +379,7 @@ in {
 
           # Mail web administration UI (Stalwart management) - exposed under /management
           mail-webadmin = {
-            rule = "Host(`mail.prg-radio.org`) && PathPrefix(`/management`)";
+            rule = "Host(`mailadmin.prg-radio.org`) && PathPrefix(`/management`)";
             service = "mail-webadmin";
             entryPoints = ["websecure"];
             tls = {certresolver = "acme";};