That is not true. Reports are just one of the features of DMARC. The policy which allows you to instruct senders what to do with unauthenticated emails is the much more relevant part an when the receiver follows it, it very much does prevent spoofing.
And what should a provider do if the dmarc policy says that none of the dkim or dmarc records should matter? What was the point of spf saying what servers could send, or dkim specifying signing keys?
"Oh, please, don't ignore the other two ways I told you to ignore unauthorized messages" shouldn't need a knob.
loading story #50418243