diff --git a/tasks/mail.yaml b/tasks/mail.yaml
index a3df119..7465fec 100644
--- a/tasks/mail.yaml
+++ b/tasks/mail.yaml
@@ -222,6 +222,14 @@
                     value: "(&(objectClass=posixAccount)(mailGroupMember=%s))"
                   - name: LDAP_QUERY_FILTER_SENDERS
                     value: "(&(objectClass=posixAccount)(|(mail=%s)(mailAlias=%s)(mailGroupMember=%s)))"
+                  # Outbound relay (Amazon SES): residential IPs are refused by Gmail et al.
+                  # Leave mail_relay_host unset to deliver directly.
+                  - name: DEFAULT_RELAY_HOST
+                    value: "{{ mail_relay_host | default('') }}"
+                  - name: RELAY_USER
+                    value: "{{ mail_relay_user | default('') }}"
+                  - name: RELAY_PASSWORD
+                    value: "{{ mail_relay_password | default('') }}"
                   - name: SPOOF_PROTECTION
                     value: "1"
                   - name: DOVECOT_AUTH_BIND