There's something called ARC https://en.wikipedia.org/wiki/Authenticated_Received_Chain which is supposed to handle forwarded emails, but no idea how it works in practice.

Sounds like kind of a hack:

"ARC was devised to solve this problem by giving intermediate servers a way to sign the original message's validation results. Even if the SPF and DKIM validation fail, the receiving service can choose to validate the ARC chain. If it indicates that the original message passed the SPF and DKIM checks, and the only modifications were made by intermediaries trusted by the receiving service, the receiving service may choose to accept the email."