Before I forget... because it freaked the shit out of me and made me think I broke the postfixadmin database.
When you create a domain in Postfixadmin, that's all fine and dandy. But when you create Mailboxes or Alias in this domain, postfixadmin performs a nameserver lookup only at THIS point in time to check the domain is valid. The helpful response is:
"The EMAIL is not valid!" (for mailbox), or "The ALIAS is not valid!".
In fact, what it means is that the domain is not valid, so this is quite misleading. So don't panic!
I thought I broke things, but all that had happened was that for this particular subdomain, while I had created an MX record for it in the zone, I hadn't reloaded DNS yet, and so a nameserver lookup was failing.
You could wait for DNS propagation (still don't understand why it wasn't almost instant, mail server was also the primary NS), or a quick getaround is to change
$CONF['emailcheck_resolve_domain']='YES';
to
$CONF['emailcheck_resolve_domain']='NO';
In the config.inc.php of postfixadmin, and it'll skip the nameserver lookup.
Phew.
