diff --git a/CHANGELOG.md b/CHANGELOG.md
index 0798200f..8502e8ba 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -24,6 +24,7 @@ and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0
 
 ### Added
 
+* **role:postfix**: Add `postfix__recipient_canonicals__group_var` / `__host_var` to rewrite recipient addresses via Postfix's `recipient_canonical_maps`, mirroring the existing sender canonical rewriting. Useful for redirecting all mail addressed to a host to a central team mailbox.
 * **all roles**: Add `lfops__skip_restart_handlers` to deploy configuration changes without restarting the affected services, for example when a bounce has to wait for a maintenance window. Reload handlers still run, since a reload applies the configuration without an outage. Note that the skipped restart is not remembered: a later ordinary run finds the configuration already correct and does not restart either, so the service has to be restarted explicitly (`--tags <role>:state --extra-vars '<role>__service_state=restarted'`). See the [README](https://github.com/Linuxfabrik/lfops/blob/main/README.md#lfops__skip_restart_handlers).
 * **role:apache_solr, role:bind, role:blocky, role:chrony, role:clamav, role:collabora, role:coturn, role:fail2ban, role:glpi_agent, role:grafana, role:graylog_datanode, role:graylog_server, role:icinga2_master, role:icinga_kubernetes, role:icingadb, role:influxdb, role:keepalived, role:opensearch, role:php, role:redis, role:snmp, role:squid, role:vsftpd**: Add a service state variable (for example `chrony__service_state`, `clamav__clamd_service_state` or `php__fpm_service_state`) to start, stop, restart or reload the managed service independently of whether it is enabled at boot. It defaults to `started` when the role's matching `*_service_enabled` is `true` and to `stopped` otherwise, so existing inventories keep their current behaviour.
 * **role:duplicity**: Add Debian and Ubuntu support (proven on Debian 12, Debian 13, Ubuntu 22.04, Ubuntu 24.04 and Ubuntu 26.04). The role now installs the `gnupg` package itself, so backups also work on minimal installs that ship without `gpg`.
diff --git a/extensions/molecule/setup_basic/inventory/group_vars/systems_under_test.yml b/extensions/molecule/setup_basic/inventory/group_vars/systems_under_test.yml
index c6f5ca51..194e1dde 100644
--- a/extensions/molecule/setup_basic/inventory/group_vars/systems_under_test.yml
+++ b/extensions/molecule/setup_basic/inventory/group_vars/systems_under_test.yml
@@ -4,7 +4,15 @@ mailto_root__to:
 
 monitoring_plugins__version: '5.0.0'
 
+postfix__recipient_canonicals__host_var:
+  - pattern: '/^.+@example.com$/'
+    address: 'team@example.com'
+    state: 'present'
 postfix__relayhost: 'mail.example.com'
+postfix__sender_canonicals__host_var:
+  - pattern: '/^.+@example.com$/'
+    address: 'noreply@example.com'
+    state: 'present'
 
 setup_basic__skip_duplicity: true
 setup_basic__skip_repo_icinga: true
diff --git a/extensions/molecule/setup_basic/verify.yml b/extensions/molecule/setup_basic/verify.yml
index db9c152f..6f52171f 100644
--- a/extensions/molecule/setup_basic/verify.yml
+++ b/extensions/molecule/setup_basic/verify.yml
@@ -36,3 +36,31 @@
       loop: '{{ __molecule__atd_state_result["results"] }}'
       loop_control:
         label: '{{ item["item"] }}'
+
+    - name: 'postconf -h sender_canonical_maps recipient_canonical_maps'
+      ansible.builtin.command: 'postconf -h sender_canonical_maps recipient_canonical_maps'
+      changed_when: false
+      register: '__molecule__postfix_canonical_maps_result'
+
+    - name: 'Assert that postfix loaded the sender and recipient canonical maps'
+      ansible.builtin.assert:
+        that:
+          - '"regexp:/etc/postfix/canonical" in __molecule__postfix_canonical_maps_result["stdout_lines"]'
+          - '"regexp:/etc/postfix/recipient_canonical" in __molecule__postfix_canonical_maps_result["stdout_lines"]'
+
+    - name: 'postmap -q against the sender and recipient canonical tables'
+      ansible.builtin.command: 'postmap -q "user@example.com" regexp:{{ item }}'
+      changed_when: false
+      register: '__molecule__postfix_postmap_query_result'
+      loop:
+        - '/etc/postfix/canonical'
+        - '/etc/postfix/recipient_canonical'
+
+    - name: 'Assert that the canonical rules rewrite addresses as configured'
+      ansible.builtin.assert:
+        that: 'item["stdout"] == __molecule__expected'
+      vars:
+        __molecule__expected: '{{ (item["item"] == "/etc/postfix/canonical") | ternary("noreply@example.com", "team@example.com") }}'
+      loop: '{{ __molecule__postfix_postmap_query_result["results"] }}'
+      loop_control:
+        label: '{{ item["item"] }}'
diff --git a/roles/postfix/README.md b/roles/postfix/README.md
index 2e9c47f0..d6f3f933 100644
--- a/roles/postfix/README.md
+++ b/roles/postfix/README.md
@@ -214,6 +214,30 @@ postfix__relayhost: 'mail.example.com:587'
 * Type: Multiline string.
 * Default: unset
 
+`postfix__recipient_canonicals__group_var` / `postfix__recipient_canonicals__host_var`
+
+* List of dictionaries for `/etc/postfix/recipient_canonical`, used to rewrite the recipient addresses.
+* For the usage in `host_vars` / `group_vars` (can only be used in one group at a time).
+* Type: List of dictionaries.
+* Default: `[]`
+* Subkeys:
+
+    * `pattern`:
+
+        * Mandatory. Regular expression to match the entire recipient address.
+        * Type: String.
+
+    * `address`:
+
+        * Mandatory. The rewrite address.
+        * Type: String.
+
+    * `state`:
+
+        * Optional. State of the entry. Either `'present'` or `'absent'`.
+        * Type: String.
+        * Default: `'present'`
+
 `postfix__recipient_delimiter`
 
 * See https://www.postfix.org/postconf.5.html#recipient_delimiter
@@ -406,6 +430,10 @@ postfix__raw: |-
   # DKIM
   smtpd_milters = inet:localhost:8891
   non_smtpd_milters = $smtpd_milters
+postfix__recipient_canonicals__host_var:
+  - pattern: '/^.+@example.com$/'
+    address: 'team@example.com'
+    state: 'present'
 postfix__recipient_delimiter: ''
 postfix__relayhost_password: ''
 postfix__relayhost_username: ''
diff --git a/roles/postfix/defaults/main.yml b/roles/postfix/defaults/main.yml
index 61380bd0..7094f837 100644
--- a/roles/postfix/defaults/main.yml
+++ b/roles/postfix/defaults/main.yml
@@ -40,6 +40,17 @@ postfix__maximal_queue_lifetime: '5d'
 postfix__message_size_limit: 10240000
 postfix__mydestination: '$myhostname, localhost.$mydomain, localhost'
 postfix__myorigin: '$myhostname'
+postfix__recipient_canonicals__combined_var: '{{ (
+      postfix__recipient_canonicals__role_var +
+      postfix__recipient_canonicals__dependent_var +
+      postfix__recipient_canonicals__group_var +
+      postfix__recipient_canonicals__host_var
+    ) | linuxfabrik.lfops.combine_lod(unique_key="pattern")
+  }}'
+postfix__recipient_canonicals__dependent_var: []
+postfix__recipient_canonicals__group_var: []
+postfix__recipient_canonicals__host_var: []
+postfix__recipient_canonicals__role_var: []
 postfix__recipient_delimiter: ''
 postfix__relayhost_password: ''
 postfix__relayhost_username: '{{ mailto_root__from }}'
diff --git a/roles/postfix/handlers/main.yml b/roles/postfix/handlers/main.yml
index 75b1332f..4b4a637f 100644
--- a/roles/postfix/handlers/main.yml
+++ b/roles/postfix/handlers/main.yml
@@ -6,6 +6,10 @@
   ansible.builtin.command: '/usr/sbin/postmap {{ __postfix__map_type }}:/etc/postfix/canonical'
   notify: 'postfix: reload postfix'
 
+- name: 'postfix: postmap /etc/postfix/recipient_canonical'
+  ansible.builtin.command: '/usr/sbin/postmap {{ __postfix__map_type }}:/etc/postfix/recipient_canonical'
+  notify: 'postfix: reload postfix'
+
 # skip reload if the service was just started (redundant) or if the user wants it stopped.
 # __postfix__service_state_result is registered on a dedicated state-only task (not the enabled
 # task), so that enabled-only changes don't prevent the reload.
diff --git a/roles/postfix/tasks/main.yml b/roles/postfix/tasks/main.yml
index df069b9e..6673fca5 100644
--- a/roles/postfix/tasks/main.yml
+++ b/roles/postfix/tasks/main.yml
@@ -65,6 +65,14 @@
       mode: 0o644
     notify: 'postfix: postmap /etc/postfix/canonical'
 
+  - name: 'Deploy /etc/postfix/recipient_canonical'
+    ansible.builtin.template:
+      backup: true
+      src: 'etc/postfix/recipient_canonical.j2'
+      dest: '/etc/postfix/recipient_canonical'
+      mode: 0o644
+    notify: 'postfix: postmap /etc/postfix/recipient_canonical'
+
   - block:
 
     - name: 'Deploy /etc/postfix/sasl_passwd'
diff --git a/roles/postfix/templates/etc/postfix/Debian-main.cf.j2 b/roles/postfix/templates/etc/postfix/Debian-main.cf.j2
index c71e9316..ac70c326 100644
--- a/roles/postfix/templates/etc/postfix/Debian-main.cf.j2
+++ b/roles/postfix/templates/etc/postfix/Debian-main.cf.j2
@@ -1,5 +1,5 @@
 # {{ ansible_managed }}
-# 2025072401
+# 2026071201
 # note: adapted from /etc/postfix/main.cf.proto as /etc/postfix/main.cf is dynamically generated via debconf
 
 # Global Postfix configuration file. This file lists only a subset
@@ -728,6 +728,7 @@ bounce_queue_lifetime = {{ postfix__bounce_queue_lifetime }}
 mailbox_size_limit = {{ postfix__mailbox_size_limit }}
 maximal_queue_lifetime = {{ postfix__maximal_queue_lifetime }}
 message_size_limit = {{ postfix__message_size_limit }}
+recipient_canonical_maps = regexp:/etc/postfix/recipient_canonical
 sender_canonical_maps = regexp:/etc/postfix/canonical
 smtp_destination_concurrency_limit = {{ postfix__smtp_destination_concurrency_limit }}
 smtp_destination_recipient_limit = {{ postfix__smtp_destination_recipient_limit }}
diff --git a/roles/postfix/templates/etc/postfix/RedHat-main.cf.j2 b/roles/postfix/templates/etc/postfix/RedHat-main.cf.j2
index a57d0b6e..06124579 100644
--- a/roles/postfix/templates/etc/postfix/RedHat-main.cf.j2
+++ b/roles/postfix/templates/etc/postfix/RedHat-main.cf.j2
@@ -1,5 +1,5 @@
 # {{ ansible_managed }}
-# 2025072401
+# 2026071201
 
 # Global Postfix configuration file. This file lists only a subset
 # of all parameters. For the syntax, and for a complete parameter
@@ -759,6 +759,7 @@ bounce_queue_lifetime = {{ postfix__bounce_queue_lifetime }}
 mailbox_size_limit = {{ postfix__mailbox_size_limit }}
 maximal_queue_lifetime = {{ postfix__maximal_queue_lifetime }}
 message_size_limit = {{ postfix__message_size_limit }}
+recipient_canonical_maps = regexp:/etc/postfix/recipient_canonical
 sender_canonical_maps = regexp:/etc/postfix/canonical
 smtp_destination_concurrency_limit = {{ postfix__smtp_destination_concurrency_limit }}
 smtp_destination_recipient_limit = {{ postfix__smtp_destination_recipient_limit }}
diff --git a/roles/postfix/templates/etc/postfix/recipient_canonical.j2 b/roles/postfix/templates/etc/postfix/recipient_canonical.j2
new file mode 100644
index 00000000..f970352a
--- /dev/null
+++ b/roles/postfix/templates/etc/postfix/recipient_canonical.j2
@@ -0,0 +1,315 @@
+# {{ ansible_managed }}
+# 2026071201
+
+# CANONICAL(5)                                                      CANONICAL(5)
+#
+# NAME
+#        canonical - Postfix canonical table format
+#
+# SYNOPSIS
+#        postmap /etc/postfix/canonical
+#
+#        postmap -q "string" /etc/postfix/canonical
+#
+#        postmap -q - /etc/postfix/canonical <inputfile
+#
+# DESCRIPTION
+#        The  optional canonical(5) table specifies an address map-
+#        ping for local and non-local  addresses.  The  mapping  is
+#        used  by the cleanup(8) daemon, before mail is stored into
+#        the queue.  The address mapping is recursive.
+#
+#        Normally, the canonical(5) table is specified  as  a  text
+#        file  that serves as input to the postmap(1) command.  The
+#        result, an indexed file in dbm or db format, is  used  for
+#        fast  searching  by  the  mail system. Execute the command
+#        "postmap /etc/postfix/canonical"  to  rebuild  an  indexed
+#        file after changing the corresponding text file.
+#
+#        When  the  table  is provided via other means such as NIS,
+#        LDAP or SQL, the same lookups are  done  as  for  ordinary
+#        indexed files.
+#
+#        Alternatively,  the  table  can  be  provided  as  a regu-
+#        lar-expression map where patterns  are  given  as  regular
+#        expressions,  or  lookups  can  be  directed  to TCP-based
+#        server. In those cases, the lookups are done in a slightly
+#        different way as described below under "REGULAR EXPRESSION
+#        TABLES" or "TCP-BASED TABLES".
+#
+#        By default the canonical(5) mapping affects  both  message
+#        header  addresses  (i.e. addresses that appear inside mes-
+#        sages) and message envelope addresses  (for  example,  the
+#        addresses  that  are used in SMTP protocol commands). This
+#        is controlled with the canonical_classes parameter.
+#
+#        NOTE: Postfix versions 2.2 and later rewrite message head-
+#        ers  from  remote  SMTP clients only if the client matches
+#        the  local_header_rewrite_clients  parameter,  or  if  the
+#        remote_header_rewrite_domain configuration parameter spec-
+#        ifies a non-empty value. To get the behavior before  Post-
+#        fix    2.2,    specify   "local_header_rewrite_clients   =
+#        static:all".
+#
+#        Typically, one would use the canonical(5) table to replace
+#        login   names   by  Firstname.Lastname,  or  to  clean  up
+#        addresses produced by legacy mail systems.
+#
+#        The canonical(5) mapping is not to be confused  with  vir-
+#        tual  alias  support or with local aliasing. To change the
+#        destination but not the headers,  use  the  virtual(5)  or
+#        sender_canonicals(5) map instead.
+#
+# CASE FOLDING
+#        The  search  string is folded to lowercase before database
+#        lookup. As of Postfix 2.3, the search string is  not  case
+#        folded  with database types such as regexp: or pcre: whose
+#        lookup fields can match both upper and lower case.
+#
+# TABLE FORMAT
+#        The input format for the postmap(1) command is as follows:
+#
+#        pattern address
+#               When  pattern matches a mail address, replace it by
+#               the corresponding address.
+#
+#        blank lines and comments
+#               Empty lines and whitespace-only lines are  ignored,
+#               as  are  lines whose first non-whitespace character
+#               is a `#'.
+#
+#        multi-line text
+#               A logical line starts with non-whitespace  text.  A
+#               line  that starts with whitespace continues a logi-
+#               cal line.
+#
+# TABLE SEARCH ORDER
+#        With lookups from indexed files such as DB or DBM, or from
+#        networked   tables   such   as  NIS,  LDAP  or  SQL,  each
+#        user@domain query produces a sequence of query patterns as
+#        described below.
+#
+#        Each  query pattern is sent to each specified lookup table
+#        before trying the next query pattern,  until  a  match  is
+#        found.
+#
+#        user@domain address
+#               Replace  user@domain  by address. This form has the
+#               highest precedence.
+#
+#               This is useful to clean up  addresses  produced  by
+#               legacy  mail  systems.  It can also be used to pro-
+#               duce Firstname.Lastname style  addresses,  but  see
+#               below for a simpler solution.
+#
+#        user address
+#               Replace  user@site by address when site is equal to
+#               $myorigin, when site is listed  in  $mydestination,
+#               or   when  it  is  listed  in  $inet_interfaces  or
+#               $proxy_interfaces.
+#
+#               This form is useful for replacing  login  names  by
+#               Firstname.Lastname.
+#
+#        @domain address
+#               Replace other addresses in domain by address.  This
+#               form has the lowest precedence.
+#
+#               Note: @domain is a wild-card.  When  this  form  is
+#               applied  to  recipient  addresses, the Postfix SMTP
+#               server accepts mail for any  recipient  in  domain,
+#               regardless  of whether that recipient exists.  This
+#               may  turn  your  mail  system  into  a  backscatter
+#               source: Postfix first accepts mail for non-existent
+#               recipients and then tries to return  that  mail  as
+#               "undeliverable" to the often forged sender address.
+#
+#               To avoid backscatter  with  mail  for  a  wild-card
+#               domain, replace the wild-card mapping with explicit
+#               1:1 mappings, or add a  reject_unverified_recipient
+#               restriction for that domain:
+#
+#                   smtpd_recipient_restrictions =
+#                       ...
+#                       reject_unauth_destination
+#                       check_recipient_access
+#                           inline:{example.com=reject_unverified_recipient}
+#                   unverified_recipient_reject_code = 550
+#
+#               In  the above example, Postfix may contact a remote
+#               server if the recipient is rewritten  to  a  remote
+#               address.
+#
+# RESULT ADDRESS REWRITING
+#        The lookup result is subject to address rewriting:
+#
+#        o      When  the  result  has  the  form @otherdomain, the
+#               result becomes the same user in otherdomain.
+#
+#        o      When "append_at_myorigin=yes", append  "@$myorigin"
+#               to addresses without "@domain".
+#
+#        o      When "append_dot_mydomain=yes", append ".$mydomain"
+#               to addresses without ".domain".
+#
+# ADDRESS EXTENSION
+#        When a mail address localpart contains the optional recip-
+#        ient  delimiter  (e.g., user+foo@domain), the lookup order
+#        becomes: user+foo@domain, user@domain, user+foo, user, and
+#        @domain.
+#
+#        The   propagate_unmatched_extensions   parameter  controls
+#        whether an unmatched address extension  (+foo)  is  propa-
+#        gated to the result of table lookup.
+#
+# REGULAR EXPRESSION TABLES
+#        This  section  describes how the table lookups change when
+#        the table is given in the form of regular expressions. For
+#        a  description  of regular expression lookup table syntax,
+#        see regexp_table(5) or pcre_table(5).
+#
+#        Each pattern is a regular expression that  is  applied  to
+#        the entire address being looked up. Thus, user@domain mail
+#        addresses are not broken up into their  user  and  @domain
+#        constituent parts, nor is user+foo broken up into user and
+#        foo.
+#
+#        Patterns are applied in the order as specified in the  ta-
+#        ble,  until  a  pattern  is  found that matches the search
+#        string.
+#
+#        Results are the same as with indexed  file  lookups,  with
+#        the  additional feature that parenthesized substrings from
+#        the pattern can be interpolated as $1, $2 and so on.
+#
+# TCP-BASED TABLES
+#        This section describes how the table lookups  change  when
+#        lookups are directed to a TCP-based server. For a descrip-
+#        tion of the TCP client/server lookup protocol, see tcp_ta-
+#        ble(5).  This feature is not available up to and including
+#        Postfix version 2.4.
+#
+#        Each lookup operation uses the entire address once.  Thus,
+#        user@domain  mail  addresses  are not broken up into their
+#        user and @domain constituent parts, nor is user+foo broken
+#        up into user and foo.
+#
+#        Results are the same as with indexed file lookups.
+#
+# BUGS
+#        The  table format does not understand quoting conventions.
+#
+# CONFIGURATION PARAMETERS
+#        The following main.cf parameters are especially  relevant.
+#        The  text  below  provides  only  a parameter summary. See
+#        postconf(5) for more details including examples.
+#
+#        canonical_classes  (envelope_sender,   envelope_recipient,
+#        header_sender, header_recipient)
+#               What  addresses  are  subject   to   canonical_maps
+#               address mapping.
+#
+#        canonical_maps (empty)
+#               Optional  address mapping lookup tables for message
+#               headers and envelopes.
+#
+#        recipient_canonical_maps (empty)
+#               Optional address mapping lookup tables for envelope
+#               and header recipient addresses.
+#
+#        sender_canonical_maps (empty)
+#               Optional address mapping lookup tables for envelope
+#               and header sender addresses.
+#
+#        propagate_unmatched_extensions (canonical, virtual)
+#               What address lookup tables copy an  address  exten-
+#               sion from the lookup key to the lookup result.
+#
+#        Other parameters of interest:
+#
+#        inet_interfaces (all)
+#               The network interface addresses that this mail sys-
+#               tem receives mail on.
+#
+#        local_header_rewrite_clients (permit_inet_interfaces)
+#               Rewrite message header addresses in mail from these
+#               clients  and  update  incomplete addresses with the
+#               domain name in $myorigin or $mydomain; either don't
+#               rewrite  message headers from other clients at all,
+#               or rewrite message headers  and  update  incomplete
+#               addresses   with   the   domain  specified  in  the
+#               remote_header_rewrite_domain parameter.
+#
+#        proxy_interfaces (empty)
+#               The network interface addresses that this mail sys-
+#               tem  receives  mail on by way of a proxy or network
+#               address translation unit.
+#
+#        masquerade_classes    (envelope_sender,     header_sender,
+#        header_recipient)
+#               What addresses are subject to address masquerading.
+#
+#        masquerade_domains (empty)
+#               Optional  list of domains whose subdomain structure
+#               will be stripped off in email addresses.
+#
+#        masquerade_exceptions (empty)
+#               Optional list of user names that are not  subjected
+#               to  address  masquerading,  even when their address
+#               matches $masquerade_domains.
+#
+#        mydestination  ($myhostname,  localhost.$mydomain,  local-
+#        host)
+#               The list of domains  that  are  delivered  via  the
+#               $local_transport mail delivery transport.
+#
+#        myorigin ($myhostname)
+#               The domain name that locally-posted mail appears to
+#               come from, and that locally posted mail  is  deliv-
+#               ered to.
+#
+#        owner_request_special (yes)
+#               Enable special treatment for owner-listname entries
+#               in the sender_canonicals(5) file, and don't split owner-list-
+#               name  and  listname-request address localparts when
+#               the recipient_delimiter is set to "-".
+#
+#        remote_header_rewrite_domain (empty)
+#               Don't rewrite message headers from  remote  clients
+#               at all when this parameter is empty; otherwise, re-
+#               write message  headers  and  append  the  specified
+#               domain name to incomplete addresses.
+#
+# SEE ALSO
+#        cleanup(8), canonicalize and enqueue mail
+#        postmap(1), Postfix lookup table manager
+#        postconf(5), configuration parameters
+#        virtual(5), virtual aliasing
+#
+# README FILES
+#        Use  "postconf  readme_directory" or "postconf html_direc-
+#        tory" to locate this information.
+#        DATABASE_README, Postfix lookup table overview
+#        ADDRESS_REWRITING_README, address rewriting guide
+#
+# LICENSE
+#        The Secure Mailer license must be  distributed  with  this
+#        software.
+#
+# AUTHOR(S)
+#        Wietse Venema
+#        IBM T.J. Watson Research
+#        P.O. Box 704
+#        Yorktown Heights, NY 10598, USA
+#
+#        Wietse Venema
+#        Google, Inc.
+#        111 8th Avenue
+#        New York, NY 10011, USA
+#
+#                                                                   CANONICAL(5)
+
+# Linuxfabrik specific settings from here
+{% for item in postfix__recipient_canonicals__combined_var if item['state'] | d('present') != 'absent' %}
+{{ item['pattern'] }} {{ item['address'] }}
+{% endfor %}