Tracking down the cause of a Postfix "Recipient address rejected: Access denied" error

Solution 1:

The sending mail server was sending mail on port 465 for some reason, which was invoking a different set of smtpd_recipient_restrictions, the much simpler:

smtps     inet  n       -       -       -       -       smtpd
  -o smtpd_tls_wrappermode=yes
  -o smtpd_sasl_auth_enable=yes
  -o broken_sasl_auth_clients=yes
  -o content_filter=
  -o smtpd_recipient_restrictions=permit_sasl_authenticated,reject
  -o milter_macro_daemon_name=ORIGINATING

Naturally, their SMTP server was not authenticating, so the Recipient Address was rejected with Access Denied.

Should I be accepting unauthenticated local delivery over 465? I certainly didn't think so.