Why does forwarded mail fail SPF?

Because forwarding changes who is sending the message without changing who it claims to be from:

• SPF checks the sending server - after a forward, that server belongs to the forwarder, not to you.
• The check fails legitimately - nothing is wrong, the mechanism simply cannot see the original hop.
• DKIM usually survives - its signature travels with the message, which is why DMARC accepts either.

This is why DKIM matters before you enforce DMARC: it is what keeps forwarded mail deliverable.