Why did a message which failed DMARC still get delivered?

The simple answer is it is 100% up to the receiver to accept, reject, or quarantine messages that fail SPF, DKIM, or DMARC. Agari Brand Protection helps you configure your mail environment to send out perfectly authenticated messages so the receiver can make the best informed choice about whether or not to accept them. On the receive side, Agari Advanced Phishing Protection knows that not all senders are perfect, and so while authentication results do play a part in the overall trust score, it is not 100% reliant on it. We expect that hard rules such as pass/fail for SPF, DKIM, and DMARC can be set.