You nag heavily to get me to set up an SPF record, but you do not implement the SPF regime properly yourselves. When email is forwarded, the Return-Path must be adjusted to follow the SRS specification. For normal forwarding you have some kind of home-made adjustment that at least prevents mail being rejected. But when Email Routing is set up, the Return-path is unchanged. So the ultimate receiving mail server sees mail arriving from zoho but with Return-path of the sender's domain, and if SPF is enforced at both ends there will be a mismatch and so a FAIL.

I know of at least one commercial mail server that was enforcing SPF but had to turn it off because of too many false positives - caused by issues such as this.  Please implement SRS properly asap.