... IF the body is not modified, and the header signature matches, AND headers retain DMARC alignment... the reality is that retransmittal (as opposed to just relaying) almost always does one or more of these.
Here's an example from a Google email engineer's recent post to the Mailop list, which is running Mailman software.
Authentication-Results: mx.google.com;
spf=neutral (google.com: 2001:41c8:51:83:feff:ff:fe00:a0b is neither permitted nor denied by best guess record for domain of mailop-bounces@mailop.org) smtp.mail=mailop-bounces@mailop.org;
dkim=neutral (body hash did not verify) header.i=@google.com;
dmarc=fail (p=REJECT dis=NONE) header.from=google.com
That message says the body was modified. The solution is simple: don't do that. Your original message said DKIM breaks if you simply relay mail, but it isn't correct.
Here's an example from a Google email engineer's recent post to the Mailop list, which is running Mailman software.
Authentication-Results: mx.google.com; spf=neutral (google.com: 2001:41c8:51:83:feff:ff:fe00:a0b is neither permitted nor denied by best guess record for domain of mailop-bounces@mailop.org) smtp.mail=mailop-bounces@mailop.org; dkim=neutral (body hash did not verify) header.i=@google.com; dmarc=fail (p=REJECT dis=NONE) header.from=google.com