diff --git a/docker-compose.yml b/docker-compose.yml
index f884e0d..a3b1063 100644
--- a/docker-compose.yml
+++ b/docker-compose.yml
@@ -3,6 +3,7 @@ services:
     image: morsequest:latest
     container_name: morsequest
     restart: unless-stopped
+    network_mode: bridge
     ports:
       - "127.0.0.1:3004:8080"
     volumes:
@@ -10,8 +11,8 @@ services:
     environment:
       PORT: "8080"
       NODE_ENV: production
-      SMTP_HOST: mail.keylinkit.net
-      SMTP_PORT: "587"
+      SMTP_HOST: 172.17.0.1
+      SMTP_PORT: "2587"
       SMTP_USER: ${SMTP_USER}
       SMTP_PASS: ${SMTP_PASS}
       ADMIN_PASSWORD: ${ADMIN_PASSWORD}
diff --git a/server/mailer.js b/server/mailer.js
index 11f5a85..acb1c43 100644
--- a/server/mailer.js
+++ b/server/mailer.js
@@ -17,10 +17,11 @@ if (SMTP_HOST && SMTP_USER && SMTP_PASS) {
     port: SMTP_PORT,
     secure: SMTP_PORT === 465,
     auth: { user: SMTP_USER, pass: SMTP_PASS },
+    requireTLS: true,  // force STARTTLS before AUTH
     connectionTimeout: 10_000,
     greetingTimeout: 10_000,
     socketTimeout: 15_000,
-    tls: { rejectUnauthorized: false }, // tunnel relay cert is for mail.keylinkit.net, not 172.17.0.1
+    tls: { rejectUnauthorized: false }, // relay cert is for mail.keylinkit.net, not 172.17.0.1
   })
   console.log(`[mailer] SMTP configured: ${SMTP_HOST}:${SMTP_PORT}`)
 } else {