Query the current DMARC policy and identify:
- policy mode;
- aggregate reporting destinations;
- alignment modes;
- subdomain policy;
- any rollout/testing controls.
Review recent aggregate reports and compare sources with the sender inventory.
Then inspect real messages from major mail streams to confirm the aligned authentication path.
A policy can look strict in DNS while legitimate senders still fail or while important subdomains follow a different effective policy.