In addition to forcing the MAIL FROM (see above) I now added a generic rewrite rule to
/etc/postfix/main.cf.d/generic
which is
@mail.ad.example.de.localhost @example.de
and the vacation email is sent from internal@example.de successfully.
(I followed the instructions here: NS8 Postfix change sender mail address - #3 by strauch)
But I don’t know if this should be the solution… 