diff --git a/checks/deltachat/default.nix b/checks/deltachat/default.nix
new file mode 100644
index 000000000..868883dda
--- /dev/null
+++ b/checks/deltachat/default.nix
@@ -0,0 +1,24 @@
+(import ../lib/container-test.nix) ({ pkgs, ... }: {
+  name = "secrets";
+
+  nodes.machine = { self, ... }: {
+    imports = [
+      ../../clanModules/deltachat.nix
+      self.nixosModules.clanCore
+      {
+        clanCore.machineName = "machine";
+        clanCore.clanDir = ./.;
+      }
+    ];
+  };
+  testScript = ''
+    start_all()
+    machine.wait_for_unit("maddy")
+    # imap
+    machine.succeed("${pkgs.netcat}/bin/nc -z -v ::1 143")
+    # smtp submission
+    machine.succeed("${pkgs.netcat}/bin/nc -z -v ::1 587")
+    # smtp
+    machine.succeed("${pkgs.netcat}/bin/nc -z -v ::1 25")
+  '';
+})
diff --git a/checks/flake-module.nix b/checks/flake-module.nix
index 66447809d..a100503cb 100644
--- a/checks/flake-module.nix
+++ b/checks/flake-module.nix
@@ -15,6 +15,7 @@
           # import our test
           secrets = import ./secrets nixosTestArgs;
           container = import ./container nixosTestArgs;
+          deltachat = import ./deltachat nixosTestArgs;
         };
         schemaTests = pkgs.callPackages ./schemas.nix {
           inherit self;
diff --git a/clanModules/deltachat.nix b/clanModules/deltachat.nix
new file mode 100644
index 000000000..66f3b0499
--- /dev/null
+++ b/clanModules/deltachat.nix
@@ -0,0 +1,139 @@
+{ config, pkgs, ... }: {
+  environment.systemPackages = [ pkgs.deltachat-desktop ];
+
+  services.maddy = {
+    enable = true;
+    primaryDomain = "${config.clanCore.machineName}.local";
+    config = ''
+      # Minimal configuration with TLS disabled, adapted from upstream example
+      # configuration here https://github.com/foxcpp/maddy/blob/master/maddy.conf
+      # Do not use this in unencrypted networks!
+
+      auth.pass_table local_authdb {
+        table sql_table {
+          driver sqlite3
+          dsn credentials.db
+          table_name passwords
+        }
+      }
+
+      storage.imapsql local_mailboxes {
+        driver sqlite3
+        dsn imapsql.db
+      }
+
+      table.chain local_rewrites {
+        optional_step regexp "(.+)\+(.+)@(.+)" "$1@$3"
+        optional_step static {
+          entry postmaster postmaster@$(primary_domain)
+        }
+        optional_step file /etc/maddy/aliases
+      }
+
+      msgpipeline local_routing {
+        destination postmaster $(local_domains) {
+          modify {
+            replace_rcpt &local_rewrites
+          }
+          deliver_to &local_mailboxes
+        }
+        default_destination {
+          reject 550 5.1.1 "User doesn't exist"
+        }
+      }
+
+      smtp tcp://[::]:25 {
+        limits {
+          all rate 20 1s
+          all concurrency 10
+        }
+        dmarc yes
+        check {
+          require_mx_record
+          dkim
+          spf
+        }
+        source $(local_domains) {
+          reject 501 5.1.8 "Use Submission for outgoing SMTP"
+        }
+        default_source {
+          destination postmaster $(local_domains) {
+            deliver_to &local_routing
+          }
+          default_destination {
+            reject 550 5.1.1 "User doesn't exist"
+          }
+        }
+      }
+
+      submission tcp://[::1]:587 {
+        limits {
+          all rate 50 1s
+        }
+        auth &local_authdb
+        source $(local_domains) {
+          check {
+              authorize_sender {
+                  prepare_email &local_rewrites
+                  user_to_email identity
+              }
+          }
+          destination postmaster $(local_domains) {
+              deliver_to &local_routing
+          }
+          default_destination {
+              modify {
+                  dkim $(primary_domain) $(local_domains) default
+              }
+              deliver_to &remote_queue
+          }
+        }
+        default_source {
+          reject 501 5.1.8 "Non-local sender domain"
+        }
+      }
+
+      target.remote outbound_delivery {
+        limits {
+          destination rate 20 1s
+          destination concurrency 10
+        }
+        mx_auth {
+          dane
+          mtasts {
+            cache fs
+            fs_dir mtasts_cache/
+          }
+          local_policy {
+              min_tls_level encrypted
+              min_mx_level none
+          }
+        }
+      }
+
+      target.queue remote_queue {
+        target &outbound_delivery
+        autogenerated_msg_domain $(primary_domain)
+        bounce {
+          destination postmaster $(local_domains) {
+            deliver_to &local_routing
+          }
+          default_destination {
+              reject 550 5.0.0 "Refusing to send DSNs to non-local addresses"
+          }
+        }
+      }
+
+      imap tcp://[::1]:143 {
+        auth &local_authdb
+        storage &local_mailboxes
+      }
+    '';
+    ensureAccounts = [
+      "user@${config.clanCore.machineName}.local"
+    ];
+    ensureCredentials = {
+      "user@${config.clanCore.machineName}.local".passwordFile = pkgs.writeText "dummy" "foobar";
+    };
+  };
+}
diff --git a/clanModules/flake-module.nix b/clanModules/flake-module.nix
index 3e03f07a3..332286a3b 100644
--- a/clanModules/flake-module.nix
+++ b/clanModules/flake-module.nix
@@ -8,6 +8,7 @@
         ];
       })
       (builtins.readDir ./diskLayouts);
+    deltachat = ./deltachat.nix;
     xfce = ./xfce.nix;
   };
 }