How can I prevent Postfix from accepting mail from domains it owns, that it didn’t send?
Solution 1:
You can prevent people using your own domains in MAIL FROM commands by putting them in a check_sender_access map after you accept mail from mynetworks and submission (SASL):
smtpd_recipient_restrictions = permit_mynetworks, permit_sasl_authenticated, check_sender_access hash:/etc/postfix/my_domains, reject_unauth_destination
And in /etc/postfix/my_domains:
example.com REJECT
example.net REJECT you're not me!
example.org REJECT go away!
As you see, you can provide custom errors too.