diff --git a/nixos/modules/mail.nix b/nixos/modules/mail.nix
index 7bfa96d..2835164 100644
--- a/nixos/modules/mail.nix
+++ b/nixos/modules/mail.nix
@@ -240,7 +240,7 @@ in {
                 private-key = "%{file:/run/secrets/dkim_rsa}%";
                 domain = "${domain}";
                 selector = "rsa-default";
-                headers = ["From" "To" "Cc" "Date" "Subject" "Message-ID" "Organization" "MIME-Version" "Content-Type" "In-Reply-To" "References" "List-Id" "User-Agent" "Thread-Topic" "Thread-Index"]; # default from https://stalw.art/docs/smtp/authentication/dkim/sign#signatures
+                headers = ["From" "To" "Cc" "Date" "Subject" "Message-ID" "Organization" "MIME-Version" "Content-Type" "In-Reply-To" "References" "List-Id" "Thread-Topic" "Thread-Index"]; # default from https://stalw.art/docs/smtp/authentication/dkim/sign#signatures except "User-Agent" which somehow breaks
                 algorithm = "rsa-sha256";
                 canonicalization = "relaxed/relaxed";
               };
@@ -248,13 +248,13 @@ in {
                 private-key = "%{file:/run/secrets/dkim_ed25519}%";
                 domain = "${domain}";
                 selector = "ed-default";
-                headers = ["From" "To" "Cc" "Date" "Subject" "Message-ID" "Organization" "MIME-Version" "Content-Type" "In-Reply-To" "References" "List-Id" "User-Agent" "Thread-Topic" "Thread-Index"];
+                headers = ["From" "To" "Cc" "Date" "Subject" "Message-ID" "Organization" "MIME-Version" "Content-Type" "In-Reply-To" "References" "List-Id" "Thread-Topic" "Thread-Index"]; # default from https://stalw.art/docs/smtp/authentication/dkim/sign#signatures except "User-Agent" which somehow breaks
                 algorithm = "ed25519-sha256";
                 canonicalization = "relaxed/relaxed";
               };
             };
           in
-            map signatureTemplate (["lists.mathebau.de"] ++ (map ({domain, ...}: domain) cfg.domains));
+            lib.attrsets.mergeAttrsList (map signatureTemplate (["lists.mathebau.de"] ++ (map ({domain, ...}: domain) cfg.domains)));
 
           authentication.fallback-admin = {
             user = "admin";