diff --git a/content/blog/2022-04-05-systemd-nspawn-postfix.md b/content/blog/2022-04-05-systemd-nspawn-postfix.md
index 53b7d52..5e83950 100644
--- a/content/blog/2022-04-05-systemd-nspawn-postfix.md
+++ b/content/blog/2022-04-05-systemd-nspawn-postfix.md
@@ -269,8 +269,7 @@ less probably, your ISP might block _inbound_ port 25. check for that here: <htt
 in my case, Centurylink blocks both directions, so i can't even use this setup to _receive_ mail.
 for this case, i'll explore running postfix on a non-standard port and using a mail forwarder or transparent proxy in a subsequent blog post.
 
-but if your mail server is working, then instruct systemd to launch the container when the host boots.
-with the container running:
+but if your mail server is working, then instruct systemd to launch the container when the host boots. while the container's active, run:
 ```sh
 [root@host /]# ln -s /opt/postfix /var/lib/machines/postfix
 [root@host /]# machinectl enable postfix
@@ -293,7 +292,7 @@ then you can stop the machine, restart it, and administer it:
 [root@host /]# machinectl login postfix
 ```
 
-once it's stable, consider disabling password login for root.
+you now have a postfix instance which starts on boot and can send/receive mail as long as port 25 is accessible. later on you may want to provide client access in a friendlier way than directly reading the spool or invoking `sendmail`. that could be done by installing something like [dovecot](https://en.wikipedia.org/wiki/Dovecot_\(software\)).
 
 <!--
 Notes: