Mail Configuration in Split DNS Setup

Question

I am a new Snow Leopard Server admin. Was wondering about proper configuration for Mail Service in a split DNS set up. Thanks in advance for your assistance!
Here are the basic configuration details (with questions to follow):
Server's fully qualified domain name: server.domain.private
Server has a private IP address which is NATted behind the public IP address on an Airport Extreme.
Mail Service: Has public IP address on Airport Extreme and uses mail.domain.com as the internet host name. The internet domain name is domain.com
Questions:
1. In Workgroup Manager, for the mail configuration tab for each LDAP user, should the mail server be listed as the fully qualified domain name for the server (server.domain.private) or the mail service's internet host name (mail.domain.com)?
2. In Squirrel Mail server settings, should the IMAP and the SMTP local host names be the fully qualified domain name for the server (server.domain.private) or the mail service's internet host name (mail.domain.com)?
3. In Server Admin - Mail - Settings - Advanced - Security: Are the options to use or require SSL certs for SMTP and IMAP/POP only for connection between mail clients on the network and the mail server? Do they impact server to server connections for mail traffic going to a recipient outside the network?
4. In the configuration described above, is the server (server.domain.private) serving as a virtual host for the internet mail host (mail.domain.com)? If so, do we need to enable virtual hosting in Server Admin - Mail - Advanced - Hosting?
Many thanks for your assistance!

Answer 1

The following (a) assumes you are running internal or using VPN to access the boxes, or (b) assumes you're not using a VPN and are using remote access.
1a: I'd use the internal name here; the direct path, and not sending traffic via public DNS and NAT.
1b: external, though that sends via public DNS and NAT when you're internal, unless you have split-horizon DNS running. If you have split horizon, you'd have example.com inside and outside, but with different IP addresses depending on which DNS server you're using; usually public static IP for your public DNS and private static for private DNS names.
2a: again, internal.
2b: again, external
3: Your clients should always use an authenticated path, which may or may not include TLS/SSL. The public path is non-secure, but can and should verify the reverse path for the sending server and that reverse verification can block even your own clients operating from a dynamic remote address.
4: If you're receiving mail for multiple domains, you need be a virtual host or an alias. I tend to go virtual here, as it provides the ability to have name collisions across the domains.
5: If the server is public, then it wants/needs a public DNS translation and the requisite matching forward and reverse DNS, and it wants/needs to be the MX server, or you need to configure it to use an authorized relay. That's usually through your ISP. If you go this route, this is the external path (the "b" path) described above.