Fwiw I keep a pre-queue instance of milter-regex https://www.benzedrine.ch/milter-regex.html
in place, for just such 'emergencies', as well as longer-term header match/action. Although it's a bit long in the tooth, and not actively supported, it still works well enough. It's a clean, easy config & relatively lightweight. Takes the burden off Postfix for header checking, and disposes of these before any heavy post-queue processing (Amavis, SA, etc).
