Authentication doesn't work after switching from DNAT to email protection (cant find server from external network/IP)

Hi all,

First off , thanks for your help in advance. So i have a UTM which had a DNAT rule to route mail to the mail server. All was fine. 

But if i enable email protection and disable the DNAT rule (to get mail monitoring,stats etc working), my email only works from internal networks!
i can receive mail fine, i can send mail fine (form webmail). But when i try to open outlook from my laptop or fetch mail from my phone , it will not let me authenticate or will not find the mail server to authenticate to. 

So from internal network all is fine. When i come from another IP from outside, i cant get mail working through sophos email protection. Only with a DNAT rule , then all works fine inside and outside, but then the email protection and monitoring and stats etc won't work because all the traffic seems to get routed around it then. Or do i have to set something else up to get the NAT routed traffic through email protection?

It looks to me that when DNAT rule is disabled, the traffic does not know where to go to authenticate.

Any idea what i'm overlooking?

Thanks again!

greets, Jerome