ok, finally got postfix to get relay auth right, permit any auth dest, deny any external host, permit auth, deny unauth dest