Without the DNS entry mail from cloudron ends up with
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@smtpcorp.com header.s=a1-4 header.b=38VpoA5C;
dkim=pass header.i=@permamed.org header.s=s1004192 header.b=IvzZvAEF;
dkim=permerror (no key for signature) header.i=@permamed.org header.s=cloudron-0d9262 header.b=cSc2yqyX;
spf=pass (google.com: domain of bounce.3wqhqixyft3pua6=46muc2596w7f=34l98tc3oj4uzw@em1004192.permamed.org designates 158.120.86.203 as permitted sender)
Once I add the entry I get
ARC-Authentication-Results: i=1; mx.google.com;
dkim=pass header.i=@smtpcorp.com header.s=a1-4 header.b=hge5ICDL;
dkim=pass header.i=@permamed.org header.s=s1004192 header.b=HnqT1ibh;
dkim=pass header.i=@permamed.org header.s=cloudron-0d9262 header.b="bpPl/+t5";
spf=pass (google.com: domain of bounce.w5qkkdyfnaxsxb7=ojoiat7bxbcy=pc4cfvy7huru7n@em1004192.permamed.org designates 158.120.86.203 as permitted sender)
