diff --git a/nixos/modules/services/mail/postfix-tlspol.nix b/nixos/modules/services/mail/postfix-tlspol.nix
index e7104d79b4fe..0841e7b6943a 100644
--- a/nixos/modules/services/mail/postfix-tlspol.nix
+++ b/nixos/modules/services/mail/postfix-tlspol.nix
@@ -94,16 +94,13 @@ in
 
           dns = {
             address = mkOption {
-              type = types.str;
-              default = if config.networking.resolvconf.useLocalResolver then "127.0.0.1:53" else null;
-              defaultText = literalExpression ''
-                if config.networking.resolvconf.useLocalResolver then
-                  "127.0.0.1:53"
-                else
-                  null
-              '';
+              type = with types; nullOr str;
+              default = null;
+              example = "127.0.0.1:53";
               description = ''
-                IP and port to your DNS resolver
+                IP and port to your DNS resolver.
+
+                Uses resolvers from /etc/resolv.conf if unset.
 
                 ::: {.note}
                 The configured DNS resolver must validate DNSSEC signatures.
diff --git a/pkgs/by-name/po/postfix-tlspol/package.nix b/pkgs/by-name/po/postfix-tlspol/package.nix
index 488d31bba16f..fb549cfde552 100644
--- a/pkgs/by-name/po/postfix-tlspol/package.nix
+++ b/pkgs/by-name/po/postfix-tlspol/package.nix
@@ -7,13 +7,13 @@
 
 buildGoModule rec {
   pname = "postfix-tlspol";
-  version = "1.8.15";
+  version = "1.8.16";
 
   src = fetchFromGitHub {
     owner = "Zuplu";
     repo = "postfix-tlspol";
     tag = "v${version}";
-    hash = "sha256-DqFBXU9b6TOujG464Ww4iAA04NA5j0z9N00F7mbV92Q=";
+    hash = "sha256-Yndu5QpPxAVbkatJDa1yqkEfnJr5M5lLImtMKvt9juQ=";
   };
 
   vendorHash = null;