I have added this text at the end of "Non-SMTPD Milter applications":
Wietse
Signing internally-generated bounce messages
Postfix normally does not apply content filters to mail that is forwarded or
aliased internally, or to mail that is generated internally such as bounces or
Postmaster notifications. Filtering internally-generated bounces could result
in loss of mail when a filter rejects or defers a message (the resulting
double-bounce message would almost certainly also be blocked).
To sign Postfix's own bounce messages, enable filtering of internally-generated
bounces (line 2 below), and don't block any mail with non_smtpd_milters,
header_checks or body_checks (lines 3-5 below).
1 /etc/postfix/main.cf:
2 internal_mail_filter_classes = bounce
3 non_smtpd_milters = nothing that can block mail
4 header_checks = nothing that can block mail
5 body_checks = nothing that can block mail
