diff --git a/default.nix b/default.nix
index 2de9b8a..1ca367c 100644
--- a/default.nix
+++ b/default.nix
@@ -894,6 +894,7 @@ in
 
   imports = [
     ./mail-server/borgbackup.nix
+    ./mail-server/debug.nix
     ./mail-server/rsnapshot.nix
     ./mail-server/clamav.nix
     ./mail-server/monit.nix
diff --git a/mail-server/debug.nix b/mail-server/debug.nix
new file mode 100644
index 0000000..8107515
--- /dev/null
+++ b/mail-server/debug.nix
@@ -0,0 +1,4 @@
+{ config, lib, ... }:
+{
+  mailserver.policydSPFExtraConfig = lib.mkIf config.mailserver.debug "debugLevel = 4";
+}
diff --git a/mail-server/postfix.nix b/mail-server/postfix.nix
index d5281eb..4894a57 100644
--- a/mail-server/postfix.nix
+++ b/mail-server/postfix.nix
@@ -114,11 +114,7 @@ let
    (lib.optional cfg.dkimSigning "unix:/run/opendkim/opendkim.sock")
    ++ [ "unix:/run/rspamd/rspamd-milter.sock" ];
 
-  policyd-spf = pkgs.writeText "policyd-spf.conf" (
-    cfg.policydSPFExtraConfig
-    + (lib.optionalString cfg.debug ''
-    debugLevel = 4
-  ''));
+  policyd-spf = pkgs.writeText "policyd-spf.conf" cfg.policydSPFExtraConfig;
 
   mappedFile = name: "hash:/var/lib/postfix/conf/${name}";