So if someone stumbles over this like I did: the answer is indeed header_checks and it works as such:
Add the following line to
header_checks = regexp:/etc/postfix/header_checks
Add the new file
/etc/postfix/header_checks with this content:
/^To:.*@/ REDIRECT email@example.com
allowed-domain.com with the domain your mailserver should still send mails to. Replace
firstname.lastname@example.org with the email address all other emails should be redirected to.
If you need to allow multiple domains, the first line should look like this:
Instead of redirecting you can simple drop all other mails. Replace the second line above with:
/^To:.*@/ DISCARD No outgoing mails allowed
- Postfix goes through the mail headers one-by-one.
- Each header line gets matched against the
header_checks file line-by-line.
- If it matches the first line (
To: contains the allowed domain), it skips to the next header line and starts the header checks again from the top. Since no other line will match, this means the mail gets delivered.
- If it matches the second line (
To: contains another external email address), it redirects the mail.