SPF
Add include:a HubSpot-provided include to your existing SPF record. Do not create a second record: two SPF records mean neither works, and that is the most common mistake in this whole area.
DKIM
Found in the HubSpot account, under Settings, then Domains and URLs, then Email Sending.
HubSpot provides DKIM records for the connected sending domain and verifies them before enabling authenticated sending.
HubSpot publishes keys under HubSpot-generated selectors, which is what an external check looks for.
DMARC
DMARC is the same regardless of provider, because it is your instruction rather than theirs. Start at v=DMARC1; p=none; rua=mailto:you@yourdomain.com, read the reports, authorise everything legitimate, and only then tighten. The DMARC guide covers the order, and the order is what stops you blocking your own invoices.
Worth knowing with HubSpot
HubSpot sends both marketing and sales mail from the same domain by default, which mixes two very different reputations. Consider separating marketing onto a subdomain.
Watch the lookup count
Every include costs one of your ten SPF lookups, and so does every include inside it. Adding a third or fourth sender is where domains typically cross the limit, after which the whole record fails silently. See the lookup guide before adding another.