diff --git a/roles/mail/templates/postfix-delivery/main.cf b/roles/mail/templates/postfix-delivery/main.cf
index 962f9eb615229da1c4e9116b96209cb8cda4b56c..18a9b1a625d899c80bb3725be3f02a1521e02ce9 100644
--- a/roles/mail/templates/postfix-delivery/main.cf
+++ b/roles/mail/templates/postfix-delivery/main.cf
@@ -6,7 +6,7 @@
 
 ldap = proxy:ldap:/etc/postfix/ldap/
 
-mynetworks = 127.0.0.0/8 [::1]/128 172.16.1.0/24
+mynetworks = 127.0.0.0/8 [::1]/128 {% for o in net_overlays %}{{ o.network }} {% endfor %}
 
 # Don't anvil(8) control the internal port.
 smtpd_client_connection_count_limit = 0
diff --git a/roles/mail/templates/postfix-out/main.cf b/roles/mail/templates/postfix-out/main.cf
index 6388046eaa7706f521f362af620bb4d33774570a..6bb3565885a59237efd55b774bb8cf8787aa579f 100644
--- a/roles/mail/templates/postfix-out/main.cf
+++ b/roles/mail/templates/postfix-out/main.cf
@@ -4,7 +4,7 @@
 
 ldap = proxy:ldap:/etc/postfix/ldap/
 
-mynetworks = 127.0.0.0/8 [::1]/128 172.16.1.0/24
+mynetworks = 127.0.0.0/8 [::1]/128 {% for o in net_overlays %}{{ o.network }} {% endfor %}
 
 smtpd_authorized_xforward_hosts = $mynetworks
 
diff --git a/roles/mail/templates/spamassassin/local.cf b/roles/mail/templates/spamassassin/local.cf
index 8311c61c9bf382bafcf6ea1f457040dd5c09fd33..2be3e2f0ca8e81cd71e1cb7b6a13adb183e3c626 100644
--- a/roles/mail/templates/spamassassin/local.cf
+++ b/roles/mail/templates/spamassassin/local.cf
@@ -11,8 +11,8 @@
 # The ring0 network is trusted, which implies that email originating
 # from them (not just relayed through) will usually not be considered
 # spam.
-trusted_networks 172.16.0.0/16
-internal_networks 172.16.0.0/16
+trusted_networks {% for o in net_overlays %}{{ o.network }} {% endfor %}
+internal_networks {% for o in net_overlays %}{{ o.network }} {% endfor %}
 
 lock_method flock