Hello, 
Thanks for the reply.
Yes, this is clearly the value impacting the system as commenting it out allows to send.  However, the confusion is that I thought the configuration matched production machine but fails on new machine and worked on old fine.  Info/example:
Thunderbird used to offer a checkbox that was for authenticating before sending.  This does not appear to exist in this version and I think the "Connection security: STARTTLS" has take on that functionality.  Thunderbird appears configured as your document states here:  http://www.iredmail.org/docs/configure.thunderbird.html and nothing changed on Thunderbird but mail system migration to new system. 
Set to:  STARTTLS via IMAP on port 587.  
It worked fine before migrating server.  
In this document: http://www.iredmail.org/docs/errors.htm … -logged-in
Now it does not send BUT I thought the system configurations matched.  Looking at below values though, I think it is different than previous settings.py but other system is off, so cannot check. 
# Enabled plugins.
#
# - Plugin name is file name which placed under 'plugins/' directory,
#   without file extension '.py'.
# - Plugins are applied in specified order. It's better to list plugins which
#   doesn't require SQL/LDAP query first (e.g. reject_null_sender), then
#   white/blacklist related plugins, e.g. amavisd_wblist.
# - Suggested order of plugins (if you enable them) for RCPT state:
#
#   1: reject_null_sender
#   2: amavisd_wblist
#   3: reject_sender_login_mismatch
#
#   LDAP backend:
#
#   4: ldap_force_change_password_in_days
#   5: ldap_maillist_access_policy
#
#   SQL backends:
#
#   4: sql_force_change_password_in_days
#   5: sql_alias_access_policy
#   6: sql_user_restrictions
#
plugins = ["reject_null_sender", "amavisd_message_size_limit", "amavisd_wblist", "sql_alias_access_policy"]
Reading Postfix docs.  I'm confused as where the issue is caused but suspect it is due to: 
"or when the client is (SASL) logged in, but the client login name doesn't own the MAIL FROM address according to $smtpd_sender_login_maps."
Is that correct? 
If it is correct, the client login matches the account name (i.e. email value matches account)
Not following this part as login maps and owner....   
http://www.postfix.org/postconf.5.html# … login_maps
Is it failing from the "type:name?"  If so, is this already configured to "type:name" when installed as mysql version, etc.?