diff --git a/README.md b/README.md
index 84f1124..8b89413 100644
--- a/README.md
+++ b/README.md
@@ -1,2 +1,12 @@
 # mailman
 
+The site-wide antispam defaults are deliberately empty:
+
+```yaml
+mailman_antispam_header_checks: []
+mailman_antispam_chain_behaviour: discard
+```
+
+Mailing-list owners can manage list-specific header matches and select their
+action (`accept`, `discard`, `hold`, or `reject`) from Postorius. The global
+chain is used only when a matching rule has no explicit action.
diff --git a/defaults/main.yml b/defaults/main.yml
index 1e6b413..c2a6439 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -118,14 +118,14 @@ mailman_arc_enabled: 'no'
 mailman_dmarc_enabled: 'yes'
 mailman_dkim_enabled: 'yes'
 
-mailman_antispam_header_checks:
-  - 'X-Spam-Flag: (YES)'
-  #- 'Authentication-Results: mail.example.com; dmarc=(fail|quarantine)'
+# Site-wide checks are intentionally empty. List owners can configure header
+# matches, including their action, from Postorius for each individual list.
+mailman_antispam_header_checks: []
 
 # The chain to jump to if any of the header patterns matches.  This must be
 # the name of an existing chain such as 'discard', 'reject', 'hold', or
 # 'accept', otherwise 'hold' will be used.
-mailman_antispam_chain_behaviour: "hold"
+mailman_antispam_chain_behaviour: "discard"
 
 mailman_start_nntp_runner: 'no'
 
@@ -184,4 +184,3 @@ mailman_postorius_cronjob_special_times:
   - 'minutely'
 
 
-