Put reject_unknown_recipient_domain in smtpd_recipient_restrictions before permit_mynetworks, permit_sasl_authenticated, and/or permit_tls_clientcerts.
If reject_unknown_sender_domain is missing from the config, or if permit_* appears before reject_unknown_sender_domain then postfix will allow all client senders matching the permit rule to send email without the recipient domain being checked. Postfix will accept the incoming mail, queue it, and only notice the domain doesn't exist when it attempts to deliver it....and then bounce the message.
If reject_unknown_sender_domain appears first, then it is checked for all clients, whether they match a permit_* rule or not, and the email is rejected with a 5xx code.
In postfix, the order of rules is always significant.
Example:
If you have the following in main.cf:
smtpd_recipient_restrictions = check_sender_access hash:/etc/postfix/junk,
check_client_access hash:/etc/postfix/junk,
check_helo_access hash:/etc/postfix/junk,
reject_unauth_pipelining,
permit_tls_clientcerts,
permit_sasl_authenticated,
permit_mynetworks
add reject_unknown_recipient_domain somewhere before the permit lines, e.g.:
smtpd_recipient_restrictions = check_sender_access hash:/etc/postfix/junk,
check_client_access hash:/etc/postfix/junk,
check_helo_access hash:/etc/postfix/junk,
reject_unauth_pipelining,
reject_unknown_recipient_domain,
permit_tls_clientcerts,
permit_sasl_authenticated,
permit_mynetworks
If you don't already have a smtpd_recipient_restrictions rule, add one like:
smtpd_recipient_restrictions = reject_unauth_pipelining,
reject_unknown_recipient_domain,
permit_mynetworks
You should, however, do some more research on configuring postfix.
