Solved. While copy and pasting the key from the domain to my hoster I removed the blanks at the beginning of the key. Keeping them will lead to a correct DNS entry.
I see sometimes is the check of port 25 green and sometimes red. The server is behind a firewall (opnsense) and the port 25 is opened. Do I have to open the firewall of the NS for the port 25 explicit?
Default behavior is smtp-ports 25, 465, 587 are open.
You may check this in cockpit System > Services and look for postfix (the smtp server on Nethserver). If the setting is not good, click on the tree little dots on the right and simply hit Edit to add/remove your desired access.