It's a shame that this one went for so long without a correct answer. And for that matter it's a shame it's not a dealt with by sendgrid's own documentation. The required directives are dealt with succinctly at http://www.postfix.org/SASL_README.html#client_sasl_sender, which I'll quote here, with some sendgrid specific modifcation:
smtp_sender_dependent_authentication = yes
sender_dependent_relayhost_maps = hash:/etc/postfix/sender_relay
smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
relayhost = my.default.relay.com
# Per-sender authentication; see also /etc/postfix/sender_relay.
# Login information for the default relayhost.
# Alternative form:
# [mail.isp.example]:submission username:password
# Per-sender provider; see also /etc/postfix/sasl_passwd.
A few notes here though.
- The above switches on the SMTP Envelope From address, not the one in the MIME Header.
- Getting postfix to send mail in different directions on the basis of MIME Header checks is more difficult. I'm sure it's possible somehow, but postfix is not designed for this.
- DKIM Doesn't care whether either the SMTP Envelope from address orthe MIME Header From address match the domain used for the DKIM signing. It may be that the spam policies of some receiving servers do care. (More info much appreciated here).
- Because of 1. and 3., you quite possibly don't need to send to separate sendgrid sub-accounts at all.