i am not really sure why it's working now.
I only join the system to the mail Dc, but i know, that this is not nessesary. And after i scanned the open ports i notice, that only 236 is open, due to an missing ssl certificate configuration of zarafa. But this is normally to be done by ourselve, it 's not integrated in the WebIf from zarafa. I found a howto on zarafa for it.
Please correct, if theres something wrong.
But i don't keep on working for it. The new comming update for 3.4 will give some (hopefully) big improvements like a fully featured webmailer and active sync. So i will try the Beta (daily) build of it.