The envelope sender is set by the mail client when sending mail; it is not a header and appears nowhere in the mail body.
Postfix, being an MTA, doesn't really care about From: headers, except insofar as it can rewrite them based on the envelope sender or some other rule, if you so desire.
This can be useful in situations where the internal postfix domain is not externally valid (such as
email@example.com) to enable the recipient to respond to the message; the envelope sender is set as the Return-Path: header upon delivery of the message.
I've never seen a requirement to perform the inverse, i.e. change the envelope sender based on a From: header; since headers are trivially forged this would enable an easy spam target.
What you should do instead is the following:
- set up postfix to require submission as defined in RFC4409, using both TLS and SASL, for all locally submitted mail; see the commented-out example in master.cf.
- disallow submission of mail via the MTA port (25) by removing
- disallow submitting mail via the sendmail(1) command and all its derivatives via the
- configure your application to use a dedicated login that will restrict the envelope sender via the smtpd_sender_login_maps parameter
- configure your application to set the proper envelope sender when submitting mail.