The problem is that all mails for domain.com will go to O365 now but there are some mailboxes not yet migrated so they still reside on our on-premise system. That's why we can't define the whole domain.
But yes, the transport file is hash'ed :) -- Sent from: http://postfix.1071664.n5.nabble.com/Postfix-Users-f2.html
