You are right — for me, security is more important than user convenience in this specific case.
If users want to forward messages, it’s their responsibility to do so in a way that preserves the “chain of trust” (DMARC, ARC, etc.). I understand you’re in a difficult situation where users are pressuring you, but as the system administrator, you are responsible for your configuration and its security.
My recommendation:
Do not lower your security measures. It’s the user’s responsibility to handle forwarding correctly, even if they lack the technical means.
If you want to experiment, you can modify your DMARC policy by changing the p parameter to p=none or p=quarantine.
This tells receiving servers (like Gmail) how strictly to enforce your DMARC checks — none means “monitor only” (no rejection), and quarantine means “mark as suspicious” rather than reject.
Keep in mind:
Lowering this setting reduces spoofing protection and makes it easier for phishers to send messages pretending to be from your domain across all DMARC-respecting servers, not just Gmail.
You could also try adding Gmail’s servers to your SPF record by including include:_spf.google.com.
However, if this works, it effectively marks all Gmail users as authorized senders for your domain = another spoofing risk.
As for SRS, since you’re talking about general Gmail users, this isn’t a viable option unless Gmail itself implemented SRS — which it doesn’t.
Unfortunately, with Gmail, it’s a bit of a Catch-22 situation. Sorry!