Look up a domain’s DMARC record at _dmarc.<domain> and see what policy it enforces on authentication failures.