diff --git a/nixos/modules/services/mail/postfix.nix b/nixos/modules/services/mail/postfix.nix
index 795a76f748a7..37ba98339a6c 100644
--- a/nixos/modules/services/mail/postfix.nix
+++ b/nixos/modules/services/mail/postfix.nix
@@ -25,7 +25,7 @@ let
 
   clientRestrictions = concatStringsSep ", " (clientAccess ++ dnsBl);
 
-  smtpTlsSecurityLevel = if cfg.useDane then "dane" else "may";
+  smtpTlsSecurityLevel = if cfg.useDane then "dane" else mkDefault "may";
 
   mainCf = let
     escape = replaceStrings ["$"] ["$$"];