diff --git a/roles/mail/files/header_checks b/roles/mail/files/header_checks
new file mode 100644
index 0000000..c8c70c3
--- /dev/null
+++ b/roles/mail/files/header_checks
@@ -0,0 +1 @@
+/^X-Spam-Flag: YES/ REDIRECT spamsink@atlantishq.de
diff --git a/roles/mail/files/main.cf b/roles/mail/files/main.cf
index a57e284..8c5bb74 100644
--- a/roles/mail/files/main.cf
+++ b/roles/mail/files/main.cf
@@ -71,6 +71,9 @@ virtual_uid_maps = static:1009
 virtual_gid_maps = static:1009
 #receive_override_options = no_address_mappings
 
+# spam redirect happens here
+header_checks = regexp:/etc/postfix/header_checks
+
 # random shit
 biff = no
 readme_directory = no
diff --git a/roles/mail/tasks/main.yaml b/roles/mail/tasks/main.yaml
index f142142..fb0350a 100644
--- a/roles/mail/tasks/main.yaml
+++ b/roles/mail/tasks/main.yaml
@@ -22,6 +22,7 @@
     - tls_policy
     - transport
     - virtual
+    - header_checks
   notify: restart postfix
 
 - name: Deploy Dovecot config