OK, it works now. I'll leave this report for posterity.
When using mail
from the commandline, postfix
has to be configured properly. It does not seem to get its smtp server settings from Mail.app (maybe it used to, but not any longer). You have to set these yourself.
The relevant documentation can be found here: http://www.postfix.org/SOHO_README.html#fantasy
These settings work:
# Set external SMTP relay host here, IP or hostname accepted along with a port
relayhost = smtp.myispserver.com:465
# Set username and password
smtp_sasl_password_maps = static:myusername:mypassword
# Enable auth
smtp_sasl_auth_enable = yes
smtp_sasl_security_options = noanonymous
# Turn on tls encryption
smtp_tls_security_level = encrypt
header_size_limit = 4096000
# For port 465
smtp_tls_wrappermode = yes
smtp_tls_security_level = encrypt
# For rewriting [email protected] to [email protected]
smtp_generic_maps = hash:/etc/postfix/generic
If outgoing port 25 is blocked, use 465 or 587.
My suspicion that the smtp server refused to accept connections with incorrect sender "From: " headers was right. The response was: Sender address rejected: Domain not found (in reply to RCPT TO command).
Use smtp_generic_maps to rewrite.
Check smtp and smtpd logs with:
log stream --predicate '(process == "smtpd") || (process == "smtp")' --info