Hi, you havematch from local for local action "local" match from any for domain <domains> action "local" match from any auth for any action "relay"in your config. So I think what you see is the expected behaviour, because sendmail did not authenticate and icloud.com is probably not in <domains>. If you want unauthenticated local connections to be able to send mails to everyone, you need to add a match from local for any.
I hope this helps. Best regards, Matthias