The default config for sendmail doesn't listen on any network interface, so we can enable it for local delivery from eg cron.