crpb DNS is verified to be correct. After tons of testing the extremely buggy firewall (OPNsense) also is verified to do everything as expected. No errors are shown in the uWSGI logs. By turning on the logs this just logs all requests and has significantly increased the amount of queries sent to the database.
Interestingly the DNS Health in the domain settings was not working. Everything stayed gray and it says unexpected character at line 1 column 1 of the JSON data pops up at the bottom of the screen after half a minute.
After digging through the source code and inserting some print statements I found out that there is an undocumented requirement that there is outgoing DNS to 1.1.1.1, 1.0.0.1, 208.67.222.222, 208.67.220.220, 208.67.222.220 needed.
This error message is also complete garbage and fake. There is no JSON issue. The request ended in a timeout as it couldn't reach external DNS servers.
After enabling outgoing DNS for the Grommunio machine, the DNS check now works. What annoys me is that the optional (blue) things don't get green when they are okay. You can see from the results that they are okay but it is not shown in the color.
Also there is a bug in the DNS check GUI. The MX record is considered optional. The MX record is required and must be shown in read and not in blue. Without the MX record mails don't work. Also in my case it should be green as the record is there and correct.
Generally the DNS Health Check seems to be entirely undocumented.
None of this did anything to what the actual problem was.
Basically the leftovers of this thread is that it works but it is impossible to tell why and that the menu is forever stuck in dark mode. It is annoying that this bug is there but it doesn't affect the core parts of the application.
Just that the custom images are ignored by the webmail is left to resolve.
Along with other issues that CatchAll doesn't work and it is apparently impossible to use shared mailboxes in Outlook for mobile devices and also mails from ProtonMail and Exchange Online never get delivered due to some TLS problem. But maybe at some point all those bugs are either solved or there is a always working workaround so I could actually sell this to customers as an Exchange replacement.
