DMARC is defined by RFC 7489.
It has this:
6.6. Mail Receiver Actions
This section describes receiver actions in the DMARC environment.
[..]
6.6.5. Store Results of DMARC Processing
The results of Mail Receiver-based DMARC processing should be stored
for eventual presentation back to the Domain Owner in the form of
aggregate feedback reports. Sections 6.3 and 7.2 discuss aggregate
feedback.
§6.3 defines the syntax and says:
rua: Addresses to which aggregate feedback is to be sent (comma-
separated plain-text list of DMARC URIs; OPTIONAL).
ruf: Addresses to which message-specific failure information is to
be reported (comma-separated plain-text list of DMARC URIs;
OPTIONAL). If present, the Domain Owner is requesting Mail
Receivers to send detailed failure reports about messages that
fail the DMARC evaluation in specific ways (see the "fo" tag
above).
Section 7 is fully devoted to "DMARC Feedback". So yes, in short, the receiving end is expected to follow rua/ruf if present and hence they are the sources of this report.
As to validate if any given email is indeed coming from Yahoo, you have to rely on traditional validating mechanisms, that is taking into account, if any, SPF/DKIM/DMARC from the receiving end of your emails that is now the sending end of the feedback report back to you.
Make sure to have a look at §7.1 that describes some protection the sender of the feedback report should follow, and the use of the _report._dmarc DNS record.
Note that both the errors and the aggregate feedback reports have specific format to follow, so you can check that to segregate valid ones from non valid ones.
