Do I need to add HoneyBook to my SPF or DMARC record?

Which address does HoneyBook send from?

Regular email communications such as messages you send through projects, client workspaces, or templates are sent from randomized addresses. Each randomized address is unique to the specific message, which is why clients may see a string of numbers and letters before @pm-inbound.honeybook.com

HoneyBook says in its own documentation that this email comes from pm-inbound.honeybook.com. That is HoneyBook's own domain, so the email is checked against HoneyBook's records, not yours.

Why does my DMARC record not cover these emails?

Author Domain: The domain name of the apparent author, as extracted from the RFC5322.From field.

DMARC is read for the domain in the From address a reader sees. When that domain is HoneyBook's, the check uses HoneyBook's records.

So your policy, from p=none to p=reject, has no effect on these emails. There is nothing to add to your SPF record for them.

Can HoneyBook send from my own domain instead?

If you connect Gmail, Outlook, iCloud, or another provider : Clients see your connected address in the "From" field

If you connect Gmail, Outlook, iCloud or another provider, clients see your connected address in the From field.

If you turn that on, the email is sent as your domain, and your SPF, DKIM and DMARC records then apply to it. Publish the records HoneyBook shows you before you raise your DMARC policy.

What should I watch for with HoneyBook email?

A forged email can copy the look of a HoneyBook message from any address. Read the address it came from, not the name shown, before you open a link or make a payment.