Migrating sendmail mailboxes to postfix

I have to wonder... Why do you want this? It sounds like you're probably expecting your mail server to do some sort of security screening that it ought not be doing. But... to answer your question...

You can probably accomplish this with the "smtpd_recipient_restrictions" option in main.cf:

smtpd_recipient_restrictions = check_recipient_access regexp:/etc/postfix/recipient_filter,
    permit_mynetworks, reject_unauth_destination

Then create a file called /etc/postfix/recipient_filter, and add your patterns:

/^user@domain.tld$/    DUNNO
/^user+.*@gmail.com$/  DUNNO
/.*/                   REJECT

The reason for DUNNO instead of OK, is so that the permit_mynetworks and reject_unauth_destination checks will still happen. With OK, presumably anyone trying to send mail (even spammers, or a virus-infested PC on your network) would be able to send email to the allowed addresses.

This configuration is untested, so may require some additional tweaking. For information on the result codes used in the /etc/postfix/recipient_filter file see read the access(5) man page here http://www.postfix.org/access.5.html.

For information on the regexp lookups supported by postfix, read here http://www.postfix.org/regexp_table.5.html.

And finally, for more information on the smtpd_recipient_restrictions option, read here http://www.postfix.org/postconf.5.html#smtpd_recipient_restrictions.

I don't know anything about iRedMail, but have done many mail migrations before on heavily used mail servers. I wouldn't recommend doing this during normal production hours. You should schedule downtime of at least an hour or two depending on how long it takes to migrate the data and turn off the mail servers while this is happening so that users aren't updating their mailboxes or getting different sets of messages.

If DNS cache time is an issue, then lower the TTL on any zone you're changing to about 10 minutes, then wait at least the previous TTL's time before doing the migration. That way when you make the switch over, you can be sure that all clients will only be about 10 minutes behind the DNS change. Then change the TTL back after you're sure everything went smoothly.