So further testing.
Mail goes to our ironport spam filters and then to plesk. the message tracking shows that mail is getting to ironport and leaving:
Message 160938042 to
[email protected] received remote SMTP response 'ok: Message 66185212 accepted'.
The bounce then would come from plesk...