SPF
Add include:a Salesforce-provided include to your existing SPF record. Do not create a second record: two SPF records mean neither works, and that is the most common mistake in this whole area.
DKIM
Found in the Salesforce or Marketing Cloud setup area, under email administration.
Salesforce configurations vary considerably by product and edition. Sender Authentication Package handles this in Marketing Cloud; plain Salesforce uses a different route.
Salesforce and Marketing Cloud publishes keys under Salesforce-generated selectors, which is what an external check looks for.
DMARC
DMARC is the same regardless of provider, because it is your instruction rather than theirs. Start at v=DMARC1; p=none; rua=mailto:you@yourdomain.com, read the reports, authorise everything legitimate, and only then tighten. The DMARC guide covers the order, and the order is what stops you blocking your own invoices.
Worth knowing with Salesforce and Marketing Cloud
Salesforce is the case where the SPF include is often added by a consultant during implementation and never revisited. It is worth confirming the include still corresponds to a product you use.
Watch the lookup count
Every include costs one of your ten SPF lookups, and so does every include inside it. Adding a third or fourth sender is where domains typically cross the limit, after which the whole record fails silently. See the lookup guide before adding another.