Short answer
HubSpot's KB: after connecting a sending domain, add a custom return-path so bounces use your domain. With strict DMARC alignment it only works if you send from a subdomain; relaxed alignment needs only the root domain to match. DNS verification can take up to 48 hours.
1. In HubSpot
The relevant screen in my demo portal.

2. Worth knowing
Until verified, HubSpot's default return-path is used.