That's not a criticism of @NCSC btw, that's exactly how a good DMARC setup should be working - it handles most of the chaff and you look at reports and see if you can deal further with repeated/major patterns