What happens if a leave as host the whole mail._domainkey.example.com, instead of mail._domainkey, and _dmarc.example.com in place of _dmarc?
Some time ago some other forum members had problems with that. Not sure, if netcup "fixes" these records in the background. Could work, but without the domain you are on the safe side.