Using ZCS 7.

Looking for pointers on the zimbra way to configure rejecting the envelope sender when it claims to be from mydomain but is originating from elsewhere. Essentially a rule that says if the connecting smtp server is not on my network(s) and the envelope Mail From: contains @mydomain then drop the connection. Advice on the zimbra commands to active this behaviour would be appreciated.

I know this doesn't stop a mail message (junk mail) presenting a "From someone@mydomain" in the message itself if the envelope test passes, but that's a different problem - and there's no obvious way to marry that data with the sending smtp server Relay Address (short of using something like mimedefang.org).