Update to this: I had to disable the 'Enable domain's SMTP auth setting for local deliveries' setting for now.  We started getting reports of bounced messages.  Basically anyone trying to send to their own domain using an SMTP other than ours was getting the Authentication is required for relay error.  One user was configured to send our through their provider's SMTP - nothing wrong with that(?) - but that message was also bounced.  That seems like a legitimate setup sending a legitimate message but as soon as SM saw the message coming from a local domain it insists on being authenticated.  I get that's what the setting is supposed to do, so I must be missing something as to how it would be usefully implemented.    Is it a realistic expectation that if your domain is hosting on SM you HAVE to use it as your SMTP server if you hope to send to your own domain?