Hi Michael, It all looks fine config wise. But seems the bounce, although going through cleanup according to log, isn't rewriting.
All I can suggest is to check there's no conflicting config elsewhere regarding canonical etc. such as master.cf overriding it etc. And maybe test the decoding by Telnet 127.0.0.1 10002 And send the following line: get<space><addresstodecode><enter> Example: get SRS0=XXXX=XX=test.com=t...@domain.com (Use the address you see in logs, bearing in mind it is only valid for a period of time.) It will either return reason it's not working, or confirm it is working and confirm it's something postfix side preventing the canonical rewriting from processing. Regards, Jason