diff --git a/setup/mail-users.sh b/setup/mail-users.sh
index e528905..d18b6e0 100755
--- a/setup/mail-users.sh
+++ b/setup/mail-users.sh
@@ -93,9 +93,16 @@ query = SELECT 1 FROM users WHERE email='%s'
 EOF
 
 # SQL statement to rewrite an email address if an alias is present.
+# Aliases have precedence over users, but that's counter-intuitive for
+# catch-all aliases ("@domain.com") which should *not* catch mail users.
+# To fix this, not only query the aliases table but also the users
+# table, i.e. turn users into aliases from themselves to themselves.
+# If there is both an alias and a user for the same address either
+# might be returned by the UNION, so the whole query is wrapped in
+# another select that prioritizes the alias definition.
 cat > /etc/postfix/virtual-alias-maps.cf << EOF;
 dbpath=$db_path
-query = SELECT destination FROM aliases WHERE source='%s'
+query = SELECT destination from (SELECT destination, 0 as priority FROM aliases WHERE source='%s' UNION SELECT email as destination, 1 as priority FROM users WHERE email='%s') ORDER BY priority LIMIT 1;
 EOF
 
 # Restart Services