I'm seeing messages occasionally where the envelope sender is a
verifiable address at someone else's domain, but the from: header
contains some non-existent user @ our local domain.
Can postfix reject those messages?
Can postfix perform address verification on from: or reply-to: headers?