Whoops, indeed, I stand corrected. What @Hillside502 noticed is correct. It seems we setup DMARC policy for outbound mail as well (but only if there is no existing record). For some reason, I thought this wasn't the case.
Since Cloudron manages DNS, it would make sense to have a custom setting to add your own includes, which Cloudron can then maintain for you..