diff --git a/roles/debian/rsyslog/defaults/main.yml b/roles/debian/rsyslog/defaults/main.yml
index 823744589..3fdf9ec04 100644
--- a/roles/debian/rsyslog/defaults/main.yml
+++ b/roles/debian/rsyslog/defaults/main.yml
@@ -5,3 +5,4 @@ rsyslog:
   role: client
   # For clients, server name or IP.
   server: my.server.example.com
+  postfix_log: true
diff --git a/roles/debian/rsyslog/tasks/main.yml b/roles/debian/rsyslog/tasks/main.yml
index 79308d49d..1e933f04f 100644
--- a/roles/debian/rsyslog/tasks/main.yml
+++ b/roles/debian/rsyslog/tasks/main.yml
@@ -8,6 +8,18 @@
     mode: "0644"
     force: true
 
+- name: Copy postfix configuration in place.
+  ansible.builtin.template:
+    src: "postfix.conf.j2"
+    dest: "/etc/25-postfix.conf"
+    owner: root
+    group: root
+    mode: "0644"
+    force: true
+  when:
+   - rsyslog.postfix_log is defined
+   - rsyslog.postfix_log
+
 - name: Restart service.
   ansible.builtin.service:
     name: rsyslog
diff --git a/roles/debian/rsyslog/templates/postfix.conf.j2 b/roles/debian/rsyslog/templates/postfix.conf.j2
new file mode 100644
index 000000000..1a2c6614e
--- /dev/null
+++ b/roles/debian/rsyslog/templates/postfix.conf.j2
@@ -0,0 +1,4 @@
+# Exclude postfix from logging into syslog
+
+if $programname startswith 'postfix' then /var/log/mail.log
+& stop