$enable_dkim_verification = 1
DMARC plugin is also apparently enabled as well as SPF and DKIM
plugins and I see hits for SPF and DKIM rules in the X-Spam-Status
header of incoming emails.
There are no DMARC and SPF plugins in Amavis. SpamAssassin has its own
SPF, DKIM and DMARC plugins, and their results are exposed as spam rule
hits. Those rule hits are available in Amavis but not treated in a
relevant way.
If I want to add DMARC validation. Can that only be done by adding an
external checker like openDMARC?
Technically no, practically mostly yes.
Amavis doesn't implement SPF or DMARC validation, so one cannot just
configure things. However, Amavis exposes a form of software interface
[1], and it is possible to use this interface to implement own
validation routines. It should even be possible to do things based on
SpamAssassins DMARC_* rule hits if this is good enough for you.
[1] https://gitlab.com/amavis/amavis/-/blob/master/conf/amavisd-custom.conf
