The AcceptMAIL ruleset for the header checks makes use of the macros ${client_name}, ${client_addr}, $f.
Let's assume the following: you use the access map, with entries like:
134.245.15.1 OK informatik.uni-kiel.de OK postmaster@aol.com OK, and an IP address which is not in your map is 1.2.3.4 , with an associated hostname example.com (this isn't correct, but you need to use IP addresses and hostnames according to your local configuration anyway).
sendmail -bt -d21.4
> .D{client_addr}134.245.15.1
> .D{client_name}informatik.uni-kiel.de
> .Dfpostmaster@aol.com
> CheckTo friend@public.com
> CheckMessageId abc
and other tests, which should be accepted.
sendmail -bt -d21.4
> .D{client_addr}1.2.3.4
> .D{client_name}example.com
> .Dfsome@example.com
> CheckTo friend@public.com
> CheckMessageId abc
This should cause an error.