diff --git a/mail/postfix/src/opnsense/mvc/app/controllers/OPNsense/Postfix/forms/general.xml b/mail/postfix/src/opnsense/mvc/app/controllers/OPNsense/Postfix/forms/general.xml
index 74bd657b2..2e974c035 100644
--- a/mail/postfix/src/opnsense/mvc/app/controllers/OPNsense/Postfix/forms/general.xml
+++ b/mail/postfix/src/opnsense/mvc/app/controllers/OPNsense/Postfix/forms/general.xml
@@ -32,7 +32,9 @@
     <field>
         <id>general.mynetworks</id>
         <label>Trusted Networks</label>
-        <type>text</type>
+        <type>select_multiple</type>
+        <style>tokenize</style>
+        <allownew>true</allownew>
         <help>The 'Trusted Networks' parameter specifies the list of trusted SMTP clients. In particular, trusted SMTP clients are allowed to relay mail through Postfix. Please use CIDR notation like 192.168.0.0/24 separated by spaces. IPv6 addresses have to be in square brackets like [::1]/128.</help>
     </field>
     <field>
@@ -41,6 +43,24 @@
         <type>text</type>
         <help>The smtpd_banner parameter specifies the text that follows the 220 code in the SMTP server's greeting banner. Default is "'System Hostname' ESMTP Postfix".</help>
     </field>
+    <field>
+        <id>general.message_size_limit</id>
+        <label>Message Size Limit</label>
+        <type>text</type>
+        <help>Set the max size for messages to accept, default is 501200000 Byte which is 50MB. Values must be entered in Bytes.</help>
+    </field>
+    <field>
+        <id>general.disable_ssl</id>
+        <label>Allow TLS Only</label>
+        <type>checkbox</type>
+        <help>Disable SSLv2 and SSLv3, only TLS allowed.</help>
+    </field>
+    <field>
+        <id>general.disable_weak_ciphers</id>
+        <label>Disable Weak Ciphers And Algorithms</label>
+        <type>checkbox</type>
+        <help>This will disable known weak ciphers like DES, RC4 or MD5.</help>
+    </field>
     <field>
         <id>general.reject_unauth_pipelining</id>
         <label>Reject Unauthenticated Pipelining</label>
@@ -81,7 +101,7 @@
     </field>
     <field>
         <id>general.permit_mynetworks</id>
-        <label>Permit My Networks</label>
+        <label>Permit Trusted Networks</label>
         <type>checkbox</type>
     </field>
     <field>
diff --git a/mail/postfix/src/opnsense/mvc/app/models/OPNsense/Postfix/General.xml b/mail/postfix/src/opnsense/mvc/app/models/OPNsense/Postfix/General.xml
index 3a79d890a..1bfd70ba5 100644
--- a/mail/postfix/src/opnsense/mvc/app/models/OPNsense/Postfix/General.xml
+++ b/mail/postfix/src/opnsense/mvc/app/models/OPNsense/Postfix/General.xml
@@ -23,14 +23,26 @@
             <default>all</default>
             <Required>Y</Required>
         </inet_interfaces>
-        <mynetworks type="TextField">
-            <default>127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128</default>
+        <mynetworks type="CSVListField">
+            <default>127.0.0.0/8,[::ffff:127.0.0.0]/104,[::1]/128</default>
             <Required>Y</Required>
         </mynetworks>
         <banner type="TextField">
             <default></default>
             <Required>N</Required>
         </banner>
+        <message_size_limit type="IntegerField">
+            <default>51200000</default>
+            <Required>Y</Required>
+        </message_size_limit>
+        <disable_ssl type="BooleanField">
+            <default>1</default>
+            <Required>Y</Required>
+        </disable_ssl>
+        <disable_weak_ciphers type="BooleanField">
+            <default>1</default>
+            <Required>Y</Required>
+        </disable_weak_ciphers>
         <check_recipient_access type="ArrayField">
         </check_recipient_access>
         <reject_unauth_pipelining type="BooleanField">
diff --git a/mail/postfix/src/opnsense/service/templates/OPNsense/Postfix/main.cf b/mail/postfix/src/opnsense/service/templates/OPNsense/Postfix/main.cf
index 3c16140c1..b9f248b5b 100644
--- a/mail/postfix/src/opnsense/service/templates/OPNsense/Postfix/main.cf
+++ b/mail/postfix/src/opnsense/service/templates/OPNsense/Postfix/main.cf
@@ -54,7 +54,7 @@ inet_interfaces = {{ OPNsense.postfix.general.inet_interfaces }}
 inet_interfaces = all
 {% endif %}
 {% if helpers.exists('OPNsense.postfix.general.mynetworks') and OPNsense.postfix.general.mynetworks != '' %}
-mynetworks = {{ OPNsense.postfix.general.mynetworks }}
+mynetworks = {{ OPNsense.postfix.general.mynetworks.replace(',', ' ') }}
 {% else %}
 mynetworks = 127.0.0.0/8 [::ffff:127.0.0.0]/104 [::1]/128
 {% endif %}
@@ -63,6 +63,18 @@ smtpd_banner = {{ OPNsense.postfix.general.banner }}
 {% else %}
 smtpd_banner = $myhostname ESMTP Postfix
 {% endif %}
+{% if helpers.exists('OPNsense.postfix.general.message_size_limit') and OPNsense.postfix.general.message_size_limit != '' %}
+message_size_limit = {{ OPNsense.postfix.general.message_size_limit }}
+{% endif %}
+{% if helpers.exists('OPNsense.postfix.general.disable_ssl') and OPNsense.postfix.general.disable_ssl == '1' %}
+smtpd_tls_mandatory_protocols=!SSLv2,!SSLv3
+smtp_tls_mandatory_protocols=!SSLv2,!SSLv3
+smtpd_tls_protocols=!SSLv2,!SSLv3
+smtp_tls_protocols=!SSLv2,!SSLv3
+{% endif %}
+{% if helpers.exists('OPNsense.postfix.general.disable_weak_ciphers') and OPNsense.postfix.general.disable_weak_ciphers == '1' %}
+smtpd_tls_exclude_ciphers = aNULL, eNULL, EXPORT, DES, RC4, MD5, PSK, aECDH, EDH-DSS-DES-CBC3-SHA, EDH-RSA-DES-CDC3-SHA, KRB5-DE5, CBC3-SHA
+{% endif %}
 
 {% if helpers.exists('OPNsense.postfix.antispam.enable_rspamd') and OPNsense.postfix.antispam.enable_rspamd == '1' %}
 smtpd_milters = inet:localhost:11332