I have a lab with a palo alto device in a deployment with a host and a server. I set up a mail server in a machine and finally I got all scenarios working fine. The most problematic connection has been when a LAN user in trust zone connect to mail server throught the public IP in untrust zone. Mail server is also in trust zone.
I could fix this scenario when reading this link https://live.paloaltonetworks.com/docs/DOC-1678 from palo alto. My problem was that I wasn't applying the source translation in the NAT rule.
In order to understand how NAT works, my question is, Why do you need to translate source address in U-Turn NAT scenario?