Sendmail relaying denied despite successful authentication

Question

I don't have a lot of experience with maintain a mail server, but in spite of that I must configure sendmail as a MTA for one of my servers. I have a problem where sendmail responds to the MUA that is trying to send mail to external domain with:

"Relaying denied. Proper authentication required."

The real problem is the fact that authentication is working and relaying is denied for authenticated users. Here is a log that shows a successful authentication but a relaying denied.

NOTE: Sensitive information (username, IP's ...) has been stripped from the logs. "myusername" is the username which MUA uses and MYIP is the IP address from which MUA connects to the sendmail.

sendmail[31285]: p4GLALtU031285: <-- STARTTLS
sendmail[31285]: p4GLALtU031285: --- 220 2.0.0 Ready to start TLS
sendmail[31285]: STARTTLS=server, get_verify: 0 get_peer: 0x0
sendmail[31285]: STARTTLS=server, relay=MYDOMAIN [MYIP], version=TLSv1/SSLv3, verify=NO, cipher=DHE-RSA-CAMELLIA256-SHA, bits=256/256
sendmail[31285]: STARTTLS=server, cert-subject=, cert-issuer=, verifymsg=ok
sendmail[31285]: AUTH: available mech=PLAIN ANONYMOUS LOGIN, allowed mech=EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN
sendmail[31285]: STARTTLS=read, info: fds=7/4, err=2
sendmail[31285]: p4GLALtU031285: <-- EHLO [127.0.0.1]
sendmail[31285]: p4GLALtV031285: --- 250-example.com Hello MYDOMAIN [MYIP], pleased to meet you
sendmail[31285]: p4GLALtV031285: --- 250-ENHANCEDSTATUSCODES
sendmail[31285]: p4GLALtV031285: --- 250-PIPELINING
sendmail[31285]: p4GLALtV031285: --- 250-8BITMIME
sendmail[31285]: p4GLALtV031285: --- 250-SIZE
sendmail[31285]: p4GLALtV031285: --- 250-DSN
sendmail[31285]: p4GLALtV031285: --- 250-ETRN
sendmail[31285]: p4GLALtV031285: --- 250-AUTH LOGIN PLAIN
sendmail[31285]: p4GLALtV031285: --- 250-DELIVERBY
sendmail[31285]: p4GLALtV031285: --- 250 HELP
sendmail[31285]: STARTTLS=read, info: fds=7/4, err=2
sendmail[31285]: p4GLALtV031285: <-- AUTH PLAIN XXXXXXXXXXXXXXXXXXXXX==
sendmail[31285]: p4GLALtV031285: --- 235 2.0.0 OK Authenticated
sendmail[31285]: AUTH=server, relay=MYDOMAIN [MYIP], authid=myusername, mech=PLAIN, bits=0
sendmail[31285]: STARTTLS=read, info: fds=7/4, err=2
sendmail[31285]: p4GLALtV031285: <-- MAIL FROM:<myusername@example.com> SIZE=382
sendmail[31285]: p4GLALtV031285: --- 250 2.1.0 <myusername@example.com>... Sender ok
sendmail[31285]: STARTTLS=read, info: fds=7/4, err=2
sendmail[31285]: p4GLALtV031285: <-- RCPT TO:<test@gmail.com>
sendmail[31285]: p4GLALtV031285: --- 550 5.7.1 <test@gmail.com>... Relaying denied. Proper authentication required.

Why does sendmail respond with "235 2.0.0 OK Authenticated" and then says "Relaying denied. Proper authentication required."? I feel like I am missing something important here.

This is the relevant part of the sendmail.mc file:

define(`confAUTH_OPTIONS', `A p')dnl
TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN'i)dnl
define(`confAUTH_MECHANISMS', `EXTERNAL GSSAPI DIGEST-MD5 CRAM-MD5 LOGIN PLAIN')dnl

Here is /etc/mail/access. It's in default state after installation

# Check the /usr/share/doc/sendmail/README.cf file for a description
# of the format of this file. (search for access_db in that file)
# The /usr/share/doc/sendmail/README.cf is part of the sendmail-doc
# package.
#
# If you want to use AuthInfo with "M:PLAIN LOGIN", make sure to have the
# cyrus-sasl-plain package installed.
#
# By default we allow relaying from localhost...
Connect:localhost.localdomain           RELAY
Connect:localhost                       RELAY
Connect:127.0.0.1                       RELAY

Answer 1

Thank you for your comments. Problem has been solved and the solution is stupid and embarrassing. Thanks to AlexD I did:

grep AuthMech sendmail.cf

and got this:

C{TrustAuthMech}EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAINi

What is that letter "i" doing there? I am not a sendmail expert but I think that this is not a proper way to specify "PLAIN" auth. I checked the .mc file and letter "i" is over here:

TRUST_AUTH_MECH(`EXTERNAL DIGEST-MD5 CRAM-MD5 LOGIN PLAIN'i)dnl

Removed it, rebuild the config, restart the server, and that was it. Everything works as expected.