DNS sending but not receiving mail to domain.tld

[fjm]

My first zimbra server with all accounts using user@host.domain.tld, and everything seemed happy. I now tried to switch to accounts using user@domain.tld and I don't receive mail. They can send from inside just fine.
I've seen similar posts and I'm happy to be pointed elsewhere to solving this... The similar threads found were not clear to me, or sighted dissimilar Zimbra configurations.

I've checked forum Changing to user@domain.com from user@mail.domain.com
and added domain.com to the @domain admin GUI, with new account names using domain.net

I've checked forum Not receiving email
and don't see where "Are DNS Lookups enabled in the admin UI" actually is in the UI.

I do have my firewall relaying DNS on the DMZ where the Zimbra server is NATed, and port forwarded to my outside ip address for host.domain.net

My ISP is hosting domain and has an A record and MX for domain.tld mail pointing to the host.domain.tld ip address.

My domain.net has a different outside ip address for www and the firewall WAN. A dig domain.tld is a separate ip from host.domain.tld

The server is CentOS 5.2 server 2.6.18-92.1.6.el5
Running split DNS, per the howto at:
Zimbra Collaboration Suite Open Source Edition On CentOS | HowtoForge - Linux Howtos and Tutorials

I see the DNS nutshell at http://www.zimbra.com/forums/adminis...-nutshell.html
however the 2005 post continues with more questions than answers I follow.

On the Zimbra host in the DMZ I see:
# host -t mx domain.net
;; connection timed out; no servers could be reached

However trying a second time I invariably see:
# host -t mx domain.net
;; Warning: ID mismatch: expected ID 43031, got 23694
;; Warning: ID mismatch: expected ID 43031, got 23694
domain.tld mail is handled by 10 host.domain.tld.

From another host in the LAN I see:
machine~: host -t mx domain.tld
domain.tld mail is handled by 10 host.domain.tld.

Trying from my ISP shell account on the WAN I see:
shell:~$ host -t mx domain.tld
domain.tld mail is handled by 10 host.domain.tld.

I see no errors in /var/log/zimbra.log following the mail coming or going out.

I'd guess my Zimbra's host DNS is not happy to let user@domain connect from the LAN and check mail, because an outside IP is returned (belatedly). Is a seperate internal DNS server required, the firewall's DNS forwarding isn't right or won't work. Might I just edit Zimbra or host files to fix... what exactly with my Zimbr and CentOS build.

Thank you.

[fjm]

As my first post didn't gather replies yet, I dig deeper in to DNS (sorry)

I had no errors in /var/log/zimbra.log as clues, and I could send mail using either user@host.domain.tld or user@domain.tld. I fixed the delayed DNS lookup in the DMZ. /var/named/chroot/etc/named.conf forwarders line had the IP of the LAN firewall port with DNS forwarding not the DMZ port with forwarding. So perhaps DNS is really fine?

Somehow hidden are authentication errors in the Zimbra client?
When I login with the user@host.domain.tld account entering username and password, and then check mail in another account (in the same Zimbra web client) added as an external mail account and the user@domain.com username and password. However if I open a separate web client and login with username@domain.tld and password, I see all the mail which was there all along, just hiding because the IMAP login failed. So I can actually get mail now... if I login differently.

I found the clue here, in a search for the meaning of "Public service host name" in the Admin GUI [SOLVED] "Public service host name" in domain creation

Can I use these fields to get this straight, and if so how.
Can my Zimbra server accept either user@domain.tld or user@host.domain.tld users (both domains are listed in @Domains)
If this is really all that is going on, can I avoid user@domain.tld accounts having to enter username@domain.tld for logging in, when the user@host.domain.tld accounts only have to enter their username?
If so, which domain gets what in the Public service host name field(s)?

And one more, since a little knowledge is dangerous... Did I do bad not doing a compete re-installation after my testing build ( I installed Zimbra with the domain host.domain.tld first to test, rather than domain.tld which would have needed the MX records live)

Thanks.