OK, this is a problem with my understanding. I couldn't find anything on forum for this.

I've got external authentication working.
To add myself I've done:

ca djve@zimbratest.xxyyzz.com '' zimbraMailCanonicalAddress djve@xxyyzz.com

and I can login.

Sending email via a telnet session to port 25 works for djve@vindiciatest.xxyyzz.com. When I try djve@xxyyzz.com I get "Relay access denied".

Now all of our user details are in LDAP and it's working with postfix, courier-imap, etc. I assume there is a mapping somewhere that I need to set that allows mail to be recieved by "djve@xxyyzz.com".

So what has my huberis caused me to miss?