Thank you! I had forgotten that we can turn the Cloudron incoming mail server off, so it won't try to set DNS records. It's working for me now.
Roundcube has to be installed on the VPS server and not in your home server.
It would be fun to be able to run an email client from Cloudron, e.g. with POP to fetch mail from the VPS. That would help with the data sovereignty point mentioned above. But for now, I'll celebrate getting email working at all.