OK, after trying for hours I found the solution - sorry for posting.
First I enabled iptables-logging to see in which way the CT tries to connect to mailserver-CT. And so I found out, that from internal-network it's over venet0 instead of eth0 - no matter, that it tried to connect via public...