Salesforce Pardot can send DMARC-compliant email via SPF or DKIM authentication.
Pardot's recommended update for your domain's SPF record is include:aspmx.pardot.com. However that has an immediate subreferral that you may want to use directly, instead, if your SPF record is close to the limit.