- Does it work if you use IP address instead of domain names like 'bb.aa.com', 'pmail.cotafer.com'?
- Do you have correct DNS records for these domain names?

If Roundcube webmail works well and you can send email out with it, that means SMTP and submission services are ok. In this case, sending email with Thunderbird should work fine with setting: port 587 with TLS (or STARTTLS), use server IP address as smtp server address.

If it doesn't work, any error in Postfix log file (/var/log/maillog)?

- case 2:
I used PHP to send mail
<?php
require_once "Mail.php";
$from = "Test <test@xxx.com>";
$to = "Kun <sitthykun@gmail.com>";
$subject = "Hi!";
$body = "Hi,\n\nHow are you?";
$host = "tls://x.x.x.x";
$port = "587";
$auth = true;
$username = "test@xxx.com";
$password = "Ujdhy3930s3RtE";
$headers = array ('From' => $from,
  'To' => $to,
  'Subject' => $subject);
$smtp = Mail::factory('smtp',
  array ('host' => $host,
    'port' => $port,
    'auth' => true,
    'username' => $username,
    'password' => $password));
$mail = $smtp->send($to, $headers, $body);
if (PEAR::isError($mail)) {
  echo("<p>" . $mail->getMessage() . "</p>");
} else {
  echo("<p>Message successfully sent!</p>");
}

?>
-----------
output:
Failed to connect to tls://x.x.x.x:587
[SMTP: Failed to connect socket: fsockopen(): unable to connect to
tls://x.x.x.x:587 (Unknown error) (code: -1, response: )]

I don't use self-signed ssl cert, because i does not work.
I use Let's Encrypt.

yes, Zhang.

I open all ports on iRedMail server.
I open all ports on MUA.
-------------------------------------------
tail -f /var/log/iredapd/iredapd.log
2018-07-20 09:52:11 INFO [x.x.x.x] RCPT, data.test@domaindo.com => test.123@gmail.com, DUNNO [sasl_username=data.test@domaindo.com, sender=data.test@domaindo.com, client_name=unknown, reverse_client_name=unknown, helo=[192.168.168.101], encryption_protocol=TLSv1.2, process_time=0.0561s]
2018-07-20 09:52:11 INFO [x.x.x.x] END-OF-MESSAGE, data.test@domaindo.com => test.123@gmail.com, DUNNO [recipient_count=1, size=444, process_time=0.0039s]
----------------------------------
tail -f /var/log/mail.log
Jul 20 09:51:18 txtmail postfix/submission/smtpd[20844]: connect from unknown[x.x.x.x]
Jul 20 09:51:21 txtmail postfix/submission/smtpd[20849]: connect from unknown[x.x.x.x]
Jul 20 09:51:44 txtmail postfix/submission/smtpd[20844]: lost connection after CONNECT from unknown[x.x.x.x]
Jul 20 09:51:44 txtmail postfix/submission/smtpd[20844]: disconnect from unknown[x.x.x.x] commands=0/0
Jul 20 09:51:50 txtmail postfix/submission/smtpd[20844]: connect from unknown[x.x.x.x]
Jul 20 09:52:10 txtmail postfix/submission/smtpd[20873]: connect from unknown[x.x.x.x]
Jul 20 09:52:11 txtmail postfix/submission/smtpd[20873]: Anonymous TLS connection established from unknown[x.x.x.x]: TLSv1.2 with cipher ECDHE-RSA-AES128-GCM-SHA256 (128/128 bits)
Jul 20 09:52:11 txtmail postfix/submission/smtpd[20873]: BC18281088: client=unknown[x.x.x.x], sasl_method=PLAIN, sasl_username=data.test@domaindo.com
Jul 20 09:52:11 txtmail postfix/cleanup[20879]: BC18281088: message-id=<2c2063ec-434b-56a9-a9ec-8401e146d999@domaindo.com>
Jul 20 09:52:11 txtmail postfix/qmgr[20706]: BC18281088: from=<data.test@domaindo.com>, size=635, nrcpt=1 (queue active)
Jul 20 09:52:12 txtmail postfix/submission/smtpd[20873]: disconnect from unknown[x.x.x.x] ehlo=2 starttls=1 auth=1 mail=1 rcpt=1 data=1 quit=1 commands=8
Jul 20 09:52:12 txtmail postfix/submission/smtpd[20873]: connect from unknown[x.x.x.x]
Jul 20 09:52:12 txtmail postfix/10025/smtpd[20888]: connect from txtmail.domaindo.com[127.0.0.1]
Jul 20 09:52:12 txtmail postfix/10025/smtpd[20888]: 2D8D0813E5: client=txtmail.domaindo.com[127.0.0.1]
Jul 20 09:52:12 txtmail postfix/cleanup[20879]: 2D8D0813E5: message-id=<2c2063ec-434b-56a9-a9ec-8401e146d999@domaindo.com>
Jul 20 09:52:12 txtmail postfix/qmgr[20706]: 2D8D0813E5: from=<data.test@domaindo.com>, size=1115, nrcpt=1 (queue active)
Jul 20 09:52:12 txtmail postfix/10025/smtpd[20888]: disconnect from txtmail.domaindo.com[127.0.0.1] ehlo=1 mail=1 rcpt=1 data=1 quit=1 commands=5
Jul 20 09:52:12 txtmail amavis[12489]: (12489-07) Passed CLEAN {RelayedInbound}, ORIGINATING [x.x.x.x]:54728 [x.x.x.x] <data.test@domaindo.com> -> <test.123@gmail.com>, Queue-ID: BC18281088, Message-ID: <2c2063ec-434b-56a9-a9ec-8401e146d999@domaindo.com>, mail_id: csMkHmJ76SsC, Hits: -1, size: 635, queued_as: 2D8D0813E5, 203 ms, Tests: [ALL_TRUSTED=-1]
Jul 20 09:52:12 txtmail postfix/amavis/smtp[20884]: BC18281088: to=<test.123@gmail.com>, relay=127.0.0.1[127.0.0.1]:10026, delay=0.69, delays=0.45/0.01/0/0.22, dsn=2.0.0, status=sent (250 2.0.0 from MTA(smtp:[127.0.0.1]:10025): 250 2.0.0 Ok: queued as 2D8D0813E5)
Jul 20 09:52:12 txtmail postfix/qmgr[20706]: BC18281088: removed
Jul 20 09:52:12 txtmail postfix/smtp[20889]: connect to gmail-smtp-in.l.google.com[2404:6800:4003:c02::1b]:25: Network is unreachable
Jul 20 09:52:12 txtmail postfix/smtp[20889]: Trusted TLS connection established to gmail-smtp-in.l.google.com[74.125.68.26]:25: TLSv1.2 with cipher ECDHE-RSA-CHACHA20-POLY1305 (256/256 bits)
Jul 20 09:52:13 txtmail postfix/submission/smtpd[20844]: lost connection after CONNECT from unknown[x.x.x.x]
Jul 20 09:52:13 txtmail postfix/submission/smtpd[20844]: disconnect from unknown[x.x.x.x] commands=0/0
Jul 20 09:52:13 txtmail postfix/smtp[20889]: 2D8D0813E5: to=<test.123@gmail.com>, relay=gmail-smtp-in.l.google.com[74.125.68.26]:25, delay=1.8, delays=0.01/0.04/0.67/1.1, dsn=2.0.0, status=sent (250 2.0.0 OK 1532080333 z9-v6si1322985pln.250 - gsmtp)
Jul 20 09:52:13 txtmail postfix/qmgr[20706]: 2D8D0813E5: removed
Jul 20 09:52:21 txtmail postfix/submission/smtpd[20844]: connect from unknown[x.x.x.x]

--------------------------------------
tail -f /var/log/letsencrypt/letsencrypt.log
2018-07-20 10:10:43,271:DEBUG:certbot.main:certbot version: 0.25.0
2018-07-20 10:10:43,272:DEBUG:certbot.main:Arguments: ['-q']
2018-07-20 10:10:43,273:DEBUG:certbot.main:Discovered plugins: PluginsRegistry(PluginEntryPoint#manual,PluginEntryPoint#nginx,PluginEntryPoint#null,PluginEntryPoint#standalone,PluginEntryPoint#webroot)
2018-07-20 10:10:43,288:DEBUG:certbot.log:Root logging level set at 30
2018-07-20 10:10:43,290:INFO:certbot.log:Saving debug log to /var/log/letsencrypt/letsencrypt.log
2018-07-20 10:10:43,301:DEBUG:certbot.plugins.selection:Requested authenticator <certbot.cli._Default object at 0x7f360614feb8> and installer <certbot.cli._Default object at 0x7f360614feb8>
2018-07-20 10:10:43,318:INFO:certbot.renewal:Cert not yet due for renewal
2018-07-20 10:10:43,319:DEBUG:certbot.plugins.selection:Requested authenticator nginx and installer nginx
2018-07-20 10:10:43,648:DEBUG:certbot.plugins.selection:Single candidate plugin: * nginx
Description: Nginx Web Server plugin - Alpha
Interfaces: IAuthenticator, IInstaller, IPlugin
Entry point: nginx = certbot_nginx.configurator:NginxConfigurator
Initialized: <certbot_nginx.configurator.NginxConfigurator object at 0x7f36061637b8>
Prep: True
2018-07-20 10:10:43,650:DEBUG:certbot.plugins.selection:Single candidate plugin: * nginx
Description: Nginx Web Server plugin - Alpha
Interfaces: IAuthenticator, IInstaller, IPlugin
Entry point: nginx = certbot_nginx.configurator:NginxConfigurator
Initialized: <certbot_nginx.configurator.NginxConfigurator object at 0x7f36061637b8>
Prep: True
2018-07-20 10:10:43,651:DEBUG:certbot.plugins.selection:Selected authenticator <certbot_nginx.configurator.NginxConfigurator object at 0x7f36061637b8> and installer <certbot_nginx.configurator.NginxConfigurator object at 0x7f36061637b8>
2018-07-20 10:10:43,651:INFO:certbot.plugins.selection:Plugins selected: Authenticator nginx, Installer nginx
2018-07-20 10:10:43,651:DEBUG:certbot.renewal:no renewal failures
---------------------------------------------
tail -f /var/log/dovecot/dovecot.log
Jul 20 11:24:47 imap(data.test@domaindo.com): Debug: acl vfile: file /var/vmail/vmail1/domaindo.com/p/r/e/data.test-2018.07.10.06.25.14//Maildir/dovecot-acl not found
Jul 20 11:24:47 imap(data.test@domaindo.com): Debug: INBOX: Mailbox opened because: SELECT
Jul 20 11:24:47 imap(data.test@domaindo.com): Debug: Drafts: Mailbox opened because: STATUS
Jul 20 11:24:47 imap(data.test@domaindo.com): Debug: Drafts: Mailbox opened because: SELECT
Jul 20 11:24:47 imap(data.test@domaindo.com): Debug: Sent: Mailbox opened because: STATUS
Jul 20 11:24:47 imap(data.test@domaindo.com): Debug: Sent: Mailbox opened because: SELECT
Jul 20 11:24:47 imap(data.test@domaindo.com): Debug: Junk: Mailbox opened because: STATUS
Jul 20 11:24:47 imap(data.test@domaindo.com): Debug: Junk: Mailbox opened because: SELECT
Jul 20 11:24:47 imap(data.test@domaindo.com): Debug: Trash: Mailbox opened because: STATUS
Jul 20 11:24:47 imap(data.test@domaindo.com): Info: Logged out in=421 out=2972