diff --git a/modules/enableit/common/data/common.yaml b/modules/enableit/common/data/common.yaml
index 85f95a6f..0fbb1621 100644
--- a/modules/enableit/common/data/common.yaml
+++ b/modules/enableit/common/data/common.yaml
@@ -144,7 +144,6 @@ common::system::classes:
   - common::system::hosts
   - common::system::kernel
   - common::system::limits
-  - common::system::mail
   - common::system::nscd
   - common::system::nsswitch
   - common::system::obmondo_admin
diff --git a/modules/enableit/common/manifests/system.pp b/modules/enableit/common/manifests/system.pp
index 109f4763..d7600039 100644
--- a/modules/enableit/common/manifests/system.pp
+++ b/modules/enableit/common/manifests/system.pp
@@ -250,8 +250,10 @@
       include $subclass
     }
 
-    # Only manage mail if not using a role that provides it
-    if $::obmondo_classes.grep('::mailcow').empty {
+    # Only manage mail if no role::mail::* subrole provides it. Those subroles
+    # (mailcow, postfix, smtprelay) declare common::system::mail themselves, so
+    # containing it here too would be a duplicate declaration.
+    if $::obmondo_classes.grep('role::mail::').empty {
       contain common::system::mail
     }
   }
diff --git a/modules/enableit/role/manifests/mail/smtprelay.pp b/modules/enableit/role/manifests/mail/smtprelay.pp
index db3aa79e..b4338697 100644
--- a/modules/enableit/role/manifests/mail/smtprelay.pp
+++ b/modules/enableit/role/manifests/mail/smtprelay.pp
@@ -28,7 +28,7 @@
   Boolean                                             $manage          = false,
   Optional[Eit_types::Host]                           $relayhost       = undef,
   Array[Variant[Eit_types::IP, Eit_types::IPCIDR]]    $allowed_networks = [],
-) {
+) inherits ::role::mail {
   # Always trust loopback so locally-generated mail relays, then the
   # operator-supplied client networks.
   $mynetworks = ['127.0.0.0/8', '[::1]/128'] + $allowed_networks