diff --git a/management/mail_log.py b/management/mail_log.py
index 1386bebf..b8494fbe 100755
--- a/management/mail_log.py
+++ b/management/mail_log.py
@@ -434,36 +434,35 @@ def scan_postfix_smtpd_line(date, log, collector):
             return
 
         # only log mail to known recipients
-        if user_match(user):
-            if collector["known_addresses"] is None or user in collector["known_addresses"]:
-                data = collector["rejected"].get(
-                    user,
-                    {
-                        "blocked": [],
-                        "earliest": None,
-                        "latest": None,
-                    }
-                )
-                # simplify this one
+        if user_match(user) and (collector["known_addresses"] is None or user in collector["known_addresses"]):
+            data = collector["rejected"].get(
+                user,
+                {
+                    "blocked": [],
+                    "earliest": None,
+                    "latest": None,
+                }
+            )
+            # simplify this one
+            m = re.search(
+                r"Client host \[(.*?)\] blocked using zen.spamhaus.org; (.*)", message
+            )
+            if m:
+                message = "ip blocked: " + m.group(2)
+            else:
+                # simplify this one too
                 m = re.search(
-                    r"Client host \[(.*?)\] blocked using zen.spamhaus.org; (.*)", message
+                    r"Sender address \[.*@(.*)\] blocked using dbl.spamhaus.org; (.*)", message
                 )
                 if m:
-                    message = "ip blocked: " + m.group(2)
-                else:
-                    # simplify this one too
-                    m = re.search(
-                        r"Sender address \[.*@(.*)\] blocked using dbl.spamhaus.org; (.*)", message
-                    )
-                    if m:
-                        message = "domain blocked: " + m.group(2)
+                    message = "domain blocked: " + m.group(2)
 
-                if data["earliest"] is None:
-                    data["earliest"] = date
-                data["latest"] = date
-                data["blocked"].append((date, sender, message))
+            if data["earliest"] is None:
+                data["earliest"] = date
+            data["latest"] = date
+            data["blocked"].append((date, sender, message))
 
-                collector["rejected"][user] = data
+            collector["rejected"][user] = data
 
 
 def scan_dovecot_login_line(date, log, collector, protocol_name):
diff --git a/management/ssl_certificates.py b/management/ssl_certificates.py
index 24797c68..d9c5ac51 100755
--- a/management/ssl_certificates.py
+++ b/management/ssl_certificates.py
@@ -82,9 +82,8 @@ def get_ssl_certificates(env):
 		for domain in cert_domains:
 			# The primary hostname can only use a certificate mapped
 			# to the system private key.
-			if domain == env['PRIMARY_HOSTNAME']:
-				if cert["private_key"]["filename"] != os.path.join(env['STORAGE_ROOT'], 'ssl', 'ssl_private_key.pem'):
-					continue
+			if domain == env['PRIMARY_HOSTNAME'] and cert["private_key"]["filename"] != os.path.join(env['STORAGE_ROOT'], 'ssl', 'ssl_private_key.pem'):
+				continue
 
 			domains.setdefault(domain, []).append(cert)
 
@@ -149,11 +148,10 @@ def get_domain_ssl_files(domain, ssl_certificates, env, allow_missing_cert=False
 			"certificate_object": load_pem(load_cert_chain(ssl_certificate)[0]),
 		}
 
-	if use_main_cert:
-		if domain == env['PRIMARY_HOSTNAME']:
-			# The primary domain must use the server certificate because
-			# it is hard-coded in some service configuration files.
-			return system_certificate
+	if use_main_cert and domain == env['PRIMARY_HOSTNAME']:
+		# The primary domain must use the server certificate because
+		# it is hard-coded in some service configuration files.
+		return system_certificate
 
 	wildcard_domain = re.sub(r"^[^\.]+", "*", domain)
 	if domain in ssl_certificates:
diff --git a/management/status_checks.py b/management/status_checks.py
index dce2718c..1f96c23b 100755
--- a/management/status_checks.py
+++ b/management/status_checks.py
@@ -420,10 +420,9 @@ def check_primary_hostname_dns(domain, env, output, dns_domains, dns_zonefiles):
 	# If a DS record is set on the zone containing this domain, check DNSSEC now.
 	has_dnssec = False
 	for zone in dns_domains:
-		if zone == domain or domain.endswith("." + zone):
-			if query_dns(zone, "DS", nxdomain=None) is not None:
-				has_dnssec = True
-				check_dnssec(zone, env, output, dns_zonefiles, is_checking_primary=True)
+		if (zone == domain or domain.endswith("." + zone)) and query_dns(zone, "DS", nxdomain=None) is not None:
+			has_dnssec = True
+			check_dnssec(zone, env, output, dns_zonefiles, is_checking_primary=True)
 
 	ip = query_dns(domain, "A")
 	ns_ips = query_dns("ns1." + domain, "A") + '/' + query_dns("ns2." + domain, "A")