hi,
Whats the 'robust' way to make sure email to a specific destination is only accepted if it came over the localhost:25 or /usr/sbin/sendmail route ? anything else should get a 5xx error. Emails to other destinations should remain unaffected.
I guess you should need to configure two incoming variant in master.cf, so you have one smtpd listening for localhost and one on the real ip. For the one on the real ip you just set a recipient restriction that disallows your specific destination (directly in master.cf itself).
I didn't test, but it should work.
Regards, Andreas