DMARC tells inbox providers what to do when neither SPF nor DKIM matches the From address. Send us one email and we'll find the DMARC record for that address.
We look up the DMARC record for the From domain and show the policy that is published. We do not decide whether this message authenticated. SPF and DKIM appear elsewhere in the report.
p=none is a watch-only policy. Inbox providers can report failures. They are not asked to quarantine or reject those messages. We do not grade one policy higher than another.
The record is public. We still need a real From address so we know which domain to look up. We try the From domain first. If that has no record, we try the parent domain.