Postfix : Relay Access Denied due to ESMTP

TLS just enables encryption on the smtp session and doesn't directly affect whether or not Postfix will be allowed to relay a message.

The relaying denied message occurs because the smtpd_recipient_restrictions rules was not matched. One of those conditions must be fulfilled to allow the message to go through:

smtpd_recipient_restrictions =
    permit_sasl_authenticated
    check_recipient_access hash:/etc/postfix/filtered_domains
    permit_mynetworks
    reject_unauth_destination

To explain those rules:

permit_sasl_authenticated

permits authenticated senders through SASL. This will be necessary to authenticate users outside of your network which are normally blocked.

check_recipient_access

This will cause postfix to look in /etc/postfix/filtered_domains for rules based on the recipient address. (Judging by the file name on the file name, it is probably just blocking specific domains... Check to see if gmail.com is listed in there?)

permit_mynetworks

This will permit hosts by IP address that match IP ranges specified in $mynetworks. In the main.cf you posted, $mynetworks was set to 127.0.0.1, so it will only relay emails generated by the server itself.

Based on that configuration, your mail client will need to use SMTP Authentication before being allowed to relay messages. I'm not sure what database SASL is using. That is specified in /usr/lib/sasl2/smtpd.conf Presumably it also uses the same database as your virtual mailboxes, so you should be able enable SMTP authentication in your mail client and be all set.

This happens when domain.com has an MX record (or, in the absence of an MX, an A record) that points to your Postfix server, but your Postfix server is not configured to accept mail for that domain. It's commonly seen in two situations:

1. You've acquired a new domain that you want to use for email, but you just forgot to add it to Postfix. There are a couple ways to do it. In my case, I'm using the virtual table to map addresses to real local users, so I list my domains in the virtual_alias_domains directive in main.cf.
2. The domain has its MX record set to a host that resolves to 127.0.0.1. Some malware will use this trick so they can set their return address to a valid domain, which most anti-spam measures will check for. However, the MX effectively prevents any delivery to that address, so the sender doesn't have to deal with replies or bounces.