DMARC is only as effective as the domain's suggested policy and the receiving server doing the right thing. It also doesn't have much if anything to do with the

DMARC is only as effective as the domain's suggested policy and the receiving server doing the right thing. It also doesn't have much if anything to do with the MUAs as they don't see any of the SPF/DKIM operations happening. DMARC doesn't do and isn't intended to do anything to verify the content or validity of an individual message.