This is the problem that SPF solves, and you can integrate it into Postfix with one of two SPF validating daemons for Postfix. The Python version is probably the best choice.
The installation will vary a bit depending on your Linux distribution, but in general you'll do what's in Ubuntu's tutorial:
In /etc/postfix/main.cf you will need to add the following line (it doesn't matter where, usually they get added to the end.
policy-spf_time_limit = 3600s
This changed the ups the policy time limit so the policy server won't time out while a message is still being processed.
Add this section to /etc/postfix/master.cf for the Python script
policy-spf unix - n n - - spawn
user=nobody argv=/usr/bin/policyd-spf
or for the Perl script
policy-spf unix - n n - - spawn
user=nobody argv=/usr/sbin/postfix-policyd-spf-perl
Finally, you need to add the policy service to your smtpd_recipient_restrictions in file /etc/postfix/main.cf:
smtpd_recipient_restrictions =
...
permit_sasl_authenticated
permit_mynetworks
reject_unauth_destination
check_policy_service unix:private/policy-spf
...
Note: Put the policy service after reject_unauth_destination to prevent unexpected responses from the policy service from making your system an open relay (this is recommended for all policy services). Moreover, put the policy service after you permit local senders. You only want SPF to check inbound mail from the internet, not outbound mail from your users.