diff --git a/app/Observers/DomainObserver.php b/app/Observers/DomainObserver.php
index 1e06f4e..fccbbc8 100644
--- a/app/Observers/DomainObserver.php
+++ b/app/Observers/DomainObserver.php
@@ -4,6 +4,7 @@ namespace App\Observers;
 
 use App\Models\DkimKey;
 use App\Models\Domain;
+use App\Models\MailUser;
 use Illuminate\Support\Facades\Log;
 use Illuminate\Support\Facades\Process;
 
@@ -17,6 +18,11 @@ class DomainObserver
     {
         if ($domain->is_server) return;
 
+        // Auto-create sysmail subdomain for every new user domain
+        if (!$domain->is_system) {
+            $this->provisionSysmail($domain);
+        }
+
         $selector = (string) config('mailpool.defaults.dkim_selector', 'mwl1');
         $bits     = (int) config('mailpool.defaults.dkim_bits', 2048);
 
@@ -40,6 +46,45 @@ class DomainObserver
         }
     }
 
+    private function provisionSysmail(Domain $domain): void
+    {
+        try {
+            $sysmailFqdn = 'sysmail.' . $domain->domain;
+
+            $sysmailDomain = Domain::firstOrCreate(
+                ['domain' => $sysmailFqdn],
+                [
+                    'is_active'                 => true,
+                    'is_system'                 => true,
+                    'max_mailboxes'             => 2,
+                    'max_aliases'               => 20,
+                    'default_quota_mb'          => 512,
+                    'max_quota_per_mailbox_mb'  => 2048,
+                    'total_quota_mb'            => 2048,
+                    'rate_limit_per_hour'       => 600,
+                    'description'               => 'System-Maildomäne für ' . $domain->domain,
+                ]
+            );
+
+            MailUser::firstOrCreate(
+                ['domain_id' => $sysmailDomain->id, 'localpart' => 'sysmail'],
+                [
+                    'email'        => 'sysmail@' . $sysmailFqdn,
+                    'display_name' => 'System Mail',
+                    'password_hash' => null,
+                    'is_system'    => true,
+                    'is_active'    => true,
+                    'can_login'    => false,
+                    'quota_mb'     => 512,
+                ]
+            );
+
+            Log::info('Sysmail domain provisioned', ['sysmail' => $sysmailFqdn, 'for' => $domain->domain]);
+        } catch (\Throwable $e) {
+            Log::error('Sysmail provisioning failed', ['domain' => $domain->domain, 'error' => $e->getMessage()]);
+        }
+    }
+
     /**
      * Beim Löschen alle DKIM-Selector dieser Domain aus OpenDKIM entfernen.
      */