According linked page on bug #3478, http://archives.neohapsis.com/archives/postfix/2013-06/0053.html, reject_unauth_destination should be listed before check_recipient_access, but first options are permit_mynetworks and permit_sasl_authenticated, or authenticated users won't be able to send email to external recipients.

You are right off course. Thanks for pointing that out.