Do the laws say you need to store this after verification? I mean a one time verification on account creation would work?

Roll your own milter using the python3-milter?

Missing dmarc records is not a dmarc fault, so you just have to reject those without a dmarc.

Maybe reject is too stronk, and a quarantine is better? Will help you debug at least if theres e-mail you are missing