Question regarding header checks and subject line rewrites.

[Eric H.]

Reviewing some old posts I came across a nice solution for handling a
situation when internal "from" addresses were being spoofed by
external parties. A solution involving the use of
smtpd_sender_restrictions was shown in the following thread:

http://groups.google.com/group/list.postfix.users/browse_thread/thread/9b8b46b05655a660?pli=1

Unfortunately I work for decentralized organization with multiple
remote offices that share the same domain (which really begs the
question of whether the addresses are really "internal") I would like
a way to rewrite the message subject line to warn of a potential
forgery if the domain for the first 'Received:' header does not match
the domain of the email address in the message "FROM:" field. I see
from the Postfix documentation a regex expressions can be used for
header and body checks but I don't know if it is possible to use them
to trigger a subject rewrite. Any advice or insight into this problem
would be most appreciated.