...
- set 'internal_networks' to include the hosts that act as MX for your domains, or that may deliver mail internally in your organisation.
- set 'trusted_networks' to include the same hosts and networks as 'internal_networks', with the addition of some hosts that are external to your organisation which you trust to not be under the control of spammers. For example, very high-volume mail relays at other ISPs, or mailing list servers. (This usage may have unintended negative consequences, such as producing inappropriate hits on headers added by servers internal to other senders' networks that shouldn't actually matter to you, eg. HELO_LOCALHOST.) Note that it doesn't matter if the server relays spam to you from other hosts; that still means you trust the server not to originate spam, which is what 'trusted_networks' specifies.
...