My understanding with DMARC is it allows you to configure your DNS to instruct e-mail servers that receive e-mail from senders from YOUR domain/e-mail server on how to handle a failed DKIM or SPF.
However, what if those recipient servers have their own e-mail gateway that is set to "allow" failed DKIM or failed SPF.
Does the DNS rule at your domain win over the recipient's server's inbound rules?