diff --git a/config-joey.hs b/config-joey.hs
index 6b99f0f..c4c90ce 100644
--- a/config-joey.hs
+++ b/config-joey.hs
@@ -413,7 +413,7 @@ monsters =	      -- but do want to track their public keys etc.
 		 - mail
 		 -   /postfix
 		 -   /postgrey
-		 -   mailman
+		 -   /mailman
 		 -   /spamassassin
 		 -   sqwebmail (cannot use this with dovecot, alternatives?)
 		 -   /imap server
@@ -438,12 +438,12 @@ monsters =	      -- but do want to track their public keys etc.
 		 - / switch kitenet.net dns and enable pop.kitenet.net etc aliass
 		 - / point wren.kitenet.net at kite.kitenet.net temporarily
 		 - / (make old.kitenet.net alias)
-		 - - reconfigure errol's email client to use new server
+		 - / reconfigure errol's email client to use new server
 		 - / on darkstar: re-run offlinimap against new server
-		 - - test mail (blocked on dns propigation)
+		 - - test sending mail (blocked on dns propigation)
 		 - - test virus filtering
 		 - / test http://kitenet.net/~kyle/ (user home dirs)
-		 - - test mailman
+		 - / test mailman
 		 - / migrate user cron jobs
 		 -}
 	, host "mouse.kitenet.net"
diff --git a/src/Propellor/Property/SiteSpecific/JoeySites.hs b/src/Propellor/Property/SiteSpecific/JoeySites.hs
index f0ce106..4eb6d47 100644
--- a/src/Propellor/Property/SiteSpecific/JoeySites.hs
+++ b/src/Propellor/Property/SiteSpecific/JoeySites.hs
@@ -482,7 +482,7 @@ kiteMailServer = propertyList "kitenet.net mail server"
 		, "header_checks = pcre:$config_directory/obscure_client_relay.pcre"
 
 		, "# Enable postgrey."
-		, "smtpd_recipient_restrictions = permit_mynetworks,reject_unauth_destination,check_policy_service inet:127.0.0.1:10023"
+		, "smtpd_recipient_restrictions = permit_tls_clientcerts,permit_mynetworks,reject_unauth_destination,check_policy_service inet:127.0.0.1:10023"
 
 		, "# Enable spamass-milter and amavis-milter."
 		, "smtpd_milters = unix:/spamass/spamass.sock unix:amavis/amavis.sock"