Do I need to add Dropbox Sign to my SPF or DMARC record?

Which address does Dropbox Sign send from?

Finally, all e-mails will come from [email protected]. It's possible your e-mail is bouncing e-mails from this address or sending them to spam.

Dropbox Sign says in its own documentation that this email comes from [email protected]. That is Dropbox Sign's own domain, so the email is checked against Dropbox Sign's records, not yours.

Why does my DMARC record not cover these emails?

Author Domain: The domain name of the apparent author, as extracted from the RFC5322.From field.

DMARC is read for the domain in the From address a reader sees. When that domain is Dropbox Sign's, the check uses Dropbox Sign's records.

So your policy, from p=none to p=reject, has no effect on these emails. There is nothing to add to your SPF record for them.

What should I watch for with Dropbox Sign email?

A forged email can copy the look of a Dropbox Sign message from any address. Read the address it came from, not the name shown, before you open a link or make a payment.