Thanks, @gerhard! DISCOURSE_SMTP_DOMAIN was not present in my app.yml but I took a deep breath, added it and yes, that does the trick. I can use my ISP’s mailbox again. On the receiving end I find in the header:
Received: from XXXXXXX.cable.dynamic.v4.ziggo.nl ([XX.XX.XX.X] helo=mydomain.tld)
by smtp7.mnd.mail.iss.as9143.net with esmtpsa (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256)
(Exim 4.90_1)
In the meantime I learned that both RFC 2821 and successor RFC 5321, section 4.1.4 state that:
An SMTP server MAY verify that the domain name argument in the EHLO command actually corresponds to the IP address of the client. However, if the verification fails, the server MUST NOT refuse to accept a message on that basis. Information captured in the verification attempt is for logging and tracing purposes. Note that this prohibition applies to the matching of the parameter to its IP address only; see Section 7.9 for a more extensive discussion of rejecting incoming connections or mail messages.
But many MTA’s like Postfix and Exim still seem to have an optional setting to do that. Possibly administrators are enabling that in the ongoing spam battle.