From address (which I think we should be able to get, at least most of

It just occurred to me that (at the expense of a DNS query) many sites can distinguish DMARC rejects pretty well by doing a DNS query for the the time). This may not help much if you have most of your users posting from p=reject sites (you can't easily distinguish an obfuscated DMARC reject from a broken recipient address), but could save some of your users trouble if you have enough non-reject posters, or those users have standard DSNs that specify a DMARC reject.

Of course you'd want to cache the result, I guess -- and actually, it would already available from when you accepted the post in the first place (if you have a non-null dmarc_moderation_action).