diff --git a/deltachat-jsonrpc/src/api/types/login_param.rs b/deltachat-jsonrpc/src/api/types/login_param.rs
index de3f54b98..72b8fd66b 100644
--- a/deltachat-jsonrpc/src/api/types/login_param.rs
+++ b/deltachat-jsonrpc/src/api/types/login_param.rs
@@ -168,7 +168,8 @@ impl From<Socket> for dc::Socket {
 #[derive(Serialize, Deserialize, TypeDef, schemars::JsonSchema, Default, PartialEq)]
 #[serde(rename_all = "camelCase")]
 pub enum EnteredCertificateChecks {
-    /// `Automatic` means strict certificate checks.
+    /// `Automatic` means strict certificate checks,
+    /// unless a legacy-domain override disables them.
     #[default]
     Automatic,
 
diff --git a/src/context.rs b/src/context.rs
index 6401ff729..25c70c95a 100644
--- a/src/context.rs
+++ b/src/context.rs
@@ -576,7 +576,6 @@ impl Context {
         let Some((transport_id, param)) = ConfiguredLoginParam::load(self).await? else {
             bail!("Not configured");
         };
-        // A relay advertising its own limit via IMAP METADATA is authoritative.
         let metadata_limit = self
             .metadata
             .read()
@@ -586,10 +585,9 @@ impl Context {
         if let Some(limit) = metadata_limit {
             return Ok(limit);
         }
-        // A few legacy domains (e.g. nauta.cu) need a hard-coded limit.
         if let Some(limit) = crate::provider::legacy_settings_for_addr(&param.addr).max_smtp_rcpt_to
         {
-            return Ok(limit as u32);
+            return Ok(limit);
         }
         Ok(constants::DEFAULT_MAX_SMTP_RCPT_TO)
     }
diff --git a/src/login_param.rs b/src/login_param.rs
index 9f6738c07..723621b43 100644
--- a/src/login_param.rs
+++ b/src/login_param.rs
@@ -37,7 +37,8 @@ use crate::tools::ToOption;
 #[repr(u32)]
 #[strum(serialize_all = "snake_case")]
 pub enum EnteredCertificateChecks {
-    /// `Automatic` means strict certificate checks.
+    /// `Automatic` means strict certificate checks,
+    /// unless a legacy-domain override disables them.
     #[default]
     Automatic = 0,
 
diff --git a/src/provider.rs b/src/provider.rs
index 00c79b5b7..7a65ac497 100644
--- a/src/provider.rs
+++ b/src/provider.rs
@@ -69,7 +69,7 @@ pub(crate) struct LegacyProviderSettings {
     pub autoconfig_servers: Option<Vec<ServerParams>>,
 
     /// Maximum number of recipients allowed in a single SMTP send, if limited.
-    pub max_smtp_rcpt_to: Option<usize>,
+    pub max_smtp_rcpt_to: Option<u32>,
 
     /// Whether to disable strict TLS certificate checks by default.
     pub disable_strict_tls: bool,
diff --git a/src/sql/migrations.rs b/src/sql/migrations.rs
index fc1d8eb4a..dd5cbc59d 100644
--- a/src/sql/migrations.rs
+++ b/src/sql/migrations.rs
@@ -1117,9 +1117,7 @@ UPDATE chats SET protected=1, type=120 WHERE type=130;"#,
         .await?;
     }
 
-    if dbversion < 71 {
-        sql.set_db_version(71).await?;
-    }
+    // Migration 71 was removed together with the provider database it read from.
     if dbversion < 72 && !sql.col_exists("msgs", "mime_modified").await? {
         sql.execute_migration(
             r#"
diff --git a/src/transport.rs b/src/transport.rs
index 951604013..70d551510 100644
--- a/src/transport.rs
+++ b/src/transport.rs
@@ -92,7 +92,8 @@ pub(crate) enum ConfiguredCertificateChecks {
     /// Alias to `AcceptInvalidCertificates` for compatibility.
     AcceptInvalidCertificates2 = 3,
 
-    /// Apply strict checks to TLS certificates.
+    /// Apply strict checks to TLS certificates,
+    /// unless a legacy-domain override disables them.
     Automatic = 4,
 }
 
@@ -464,13 +465,8 @@ impl ConfiguredLoginParam {
         let disable_strict_tls =
             crate::provider::legacy_settings_for_addr(&self.addr).disable_strict_tls;
         match self.certificate_checks {
-            ConfiguredCertificateChecks::OldAutomatic => {
-                if disable_strict_tls {
-                    false
-                } else {
-                    connected_through_proxy
-                }
-            }
+            ConfiguredCertificateChecks::OldAutomatic if disable_strict_tls => false,
+            ConfiguredCertificateChecks::OldAutomatic => connected_through_proxy,
             ConfiguredCertificateChecks::Automatic => !disable_strict_tls,
             ConfiguredCertificateChecks::Strict => true,
             ConfiguredCertificateChecks::AcceptInvalidCertificates