diff --git a/docs/rolereference.rst b/docs/rolereference.rst
index 2f184fd709029d6cdaf3981b5f5dff545b8e372f..cd3158fb57d17ef3b70261888e6924095be362c7 100644
--- a/docs/rolereference.rst
+++ b/docs/rolereference.rst
@@ -1073,6 +1073,9 @@ Deployed services are configured as follows:
   below).
 * Postfix is configured to deliver undeliverable bounces to postmaster. This
   helps with detecting misconfigured applications and servers.
+* Postfix is configured to prevent forging of sender addresses for
+  logged-in users. Logged-in users can use either their own e-mail as
+  sender, or one of the aliases associated with their e-mail.
 
 Both Postfix and Dovecot expect a specific directory structure in LDAP when
 doing look-ups: