This source is known to forward email
Our data indicates Sophos Email Security supports full DMARC compliance.
Contact Sophos for DKIM setup.
The addition to your SPF suggested by Sophos is 'include:_spf.prod.hydra.sophos.com'. Please note however this pulls in additional includes, respectively taking up DNS lookup limits for your SPF. More on their SPF policy can be found here: https://support.sophos.com/support/s/article/KB-000038188?language=en_US