@mmolivier yes, I think your interpretation is correct. One quick question, why not use the sendgrid/mailgun credentials directly in your app? You don't need to go via cloudron mail server in this case, no?
A setting that would help in your specific case is to allow apps to send without MAIL FROM validation . This would avoid the whole dance around creating relay tokens cc @girish