OK, this is a problem with my understanding. I couldn't find anything on forum for this.
I've got external authentication working.
To add myself I've done:
ca email@example.com '' zimbraMailCanonicalAddress firstname.lastname@example.org
and I can login.
Sending email via a telnet session to port 25 works for email@example.com. When I try firstname.lastname@example.org I get "Relay access denied".
Now all of our user details are in LDAP and it's working with postfix, courier-imap, etc. I assume there is a mapping somewhere that I need to set that allows mail to be recieved by "email@example.com".
So what has my huberis caused me to miss?