diff --git a/charts/mail-gateway/templates/maddy.yaml b/charts/mail-gateway/templates/maddy.yaml
index c80fe90..d3469b7 100644
--- a/charts/mail-gateway/templates/maddy.yaml
+++ b/charts/mail-gateway/templates/maddy.yaml
@@ -1,143 +1,3 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: maddy
-  namespace: {{ .Release.Namespace }}
-data:
-  maddy.conf: |
-    $(hostname) = {{ .Values.mxHostname }}
-    $(primary_domain) = {{ .Values.domains.primary.name }}
-    $(local_domains) = {{ .Values.domains.primary.name }}{{ range .Values.domains.others }} {{ .name }}{{ end }}
-
-    tls file /etc/maddy/certs/tls.crt /etc/maddy/certs/tls.key
-
-    auth.external authsmtp {
-        helper /usr/bin/auth-smtp
-        perdomain yes
-        domains $(local_domains)
-    }
-
-    hostname $(hostname)
-
-    msgpipeline local_routing {
-        destination {{ .Values.domains.primary.name }} {
-            deliver_to &{{ .Values.domains.primary.name }}
-        }
-        {{ range .Values.domains.others }}
-        destination {{ .name }} {
-            deliver_to &{{ .name }}
-        }
-        {{ end }}
-        default_destination {
-            reject 550 5.1.1 "User doesn't exist"
-        }
-    }
-
-    smtp tcp://0.0.0.0:25 {
-        insecure_auth no
-
-        defer_sender_reject yes
-
-        limits {
-            # Up to 20 msgs/sec across max. 10 SMTP connections.
-            all rate 20 1s
-            all concurrency 10
-        }
-
-        dmarc yes
-        check {
-            require_mx_record
-            dkim
-            spf
-        }
-
-        source $(local_domains) {
-            reject 501 5.1.8 "Use Submission for outgoing SMTP"
-        }
-        default_source {
-            destination $(local_domains) {
-                deliver_to &local_routing
-            }
-            default_destination {
-                reject 550 5.1.1 "User doesn't exist"
-            }
-        }
-    }
-
-    submission tls://0.0.0.0:465 tcp://0.0.0.0:587 {
-        auth &authsmtp
-        insecure_auth yes
-
-        defer_sender_reject yes
-
-        source $(local_domains) {
-            destination $(local_domains) {
-                deliver_to &local_routing
-            }
-            default_destination {
-                modify {
-                    dkim $(primary_domain) $(local_domains) default
-                }
-                deliver_to &remote_queue
-            }
-        }
-        default_source {
-            reject 501 5.1.8 "Non-local sender domain"
-        }
-    }
-
-    target.smtp {{ .Values.domains.primary.name }} {
-        hostname $(hostname)
-        attempt_starttls false
-        require_tls no
-        auth off
-        targets tcp://maddy.{{ .Values.domains.primary.namespace }}.svc.cluster.local:25
-    }
-
-    {{ range .Values.domains.others }}
-    target.smtp {{ .name }} {
-        hostname mail.{{ .name }}
-        attempt_starttls false
-        require_tls no
-        auth off
-        targets tcp://maddy.{{ .namespace }}.svc.cluster.local:25
-    }
-    {{ end }}
-
-    target.queue remote_queue {
-        target &outbound_delivery
-
-        autogenerated_msg_domain $(primary_domain)
-        bounce {
-            destination postmaster $(local_domains) {
-                deliver_to &local_routing
-            }
-            default_destination {
-                reject 550 5.0.0 "Refusing to send DSNs to non-local addresses"
-            }
-        }
-    }
-
-    target.remote outbound_delivery {
-        limits {
-            # Up to 20 msgs/sec across max. 10 SMTP connections
-            # for each recipient domain.
-            destination rate 20 1s
-            destination concurrency 10
-        }
-        mx_auth {
-            dane
-            mtasts {
-                cache fs
-                fs_dir mtasts_cache/
-            }
-            local_policy {
-                min_tls_level encrypted
-                min_mx_level none
-            }
-        }
-    }
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -152,6 +12,8 @@
     metadata:
       labels:
         app: maddy
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/config.yaml") . | sha256sum }}
     spec:
       volumes:
       - name: config
@@ -159,7 +21,7 @@
           name: maddy
       - name: certs
         secret:
-          secretName: cert-{{ .Values.mxHostname }}
+          secretName: cert-{{ .Values.domains.primary.mx }}
       - name: data
         persistentVolumeClaim:
           claimName: data