@cks yes, for DMARC you need an aligned SPF pass OR a DKIM pass. If you're forwarding, the former isn't going to happen, so you're reliant on DKIM. Sensible people don't enable strict DMARC policies without first ensuring that they're DKIMing everything, so that shouldn't be an issue, but forwarding mail that isn't DKIM signed (and lots still isn't) is unlikely to be reliable, even if the sender hasn't explicitly said "p=reject".