From: "Peter A. Giessel" <pgiessel@mac.com>:

Not totally true. Typical cyrus sasl2 implementation used with sendmail uses an imap server for smtp authentication. I recall having to tweak the sasl2 configuration on my own sendmail server to talk correctly with dovecot. I don't recall the exact tweaks.

Just to make it clear to the OP, I have a Dovecot/Sendmail/SASL working just fine (which is independent of dovecot). I suspect Peter hit the nail on the head here. Look at the contents of

$SASL_INSTALL/lib/Sendmail.conf

Mine is (only)

pwcheck_method:saslauthd

which I think looks up my name service backend via the login and plain plugins. I'm a little hazy on how this was set up, but if you are able to successfully login without dovecot, then it appears you have some sort of authentication stack that will try IMAP first, then fallback to your the other method.

Joseph Tam <jtam.home@gmail.com>