Timo,
Thank you for trying to help, but I'm out of time on this. I switched everything over to the PLAIN mechanism with BLF-CRYPT hashes and it works fine. I'm guessing there's something broken with DIGEST-MD5, but can't say if the fault is in Dovecot 2 or Postfix. Given that it's obsoleted by SCRAM, that doesn't bother me much. Now I just need to either get SCRAM support into cyrus-sasl, or SASL client support from Dovecot. I'd much rather the latter, of course. :)
