I don't believe this is true, the only knob to tune is for relaxed or strict alignment checks for DKIM and SPF.

How do you configure DMARC to require both of DKIM and SPF?

The RFC says:

https://datatracker.ietf.org/doc/html/rfc7489#section-4.2

   A message satisfies the DMARC checks if at least one of the supported
   authentication mechanisms:

   1.  produces a "pass" result, and

   2.  produces that result based on an identifier that is in alignment,
       as defined in Section 3.