When you have a gateway like Cisco, you will see a lot of emails demonstrating to be forwarded through Cisco, when they originally came from a sender like Salesforce.

This is because Cisco is checking the incoming messages for suspicious links or scanning the content of the message, but when it forwards those messages (that originate from Salesforce) it might break SPF authentication because it would now look like it came from Cisco.

One way to resolve forwarding issues is to setup the DKIM keys which will increase the deliverability rate for services, like Salesforce, that are getting auto-forwarded from the gateway, like Cisco, to the mailbox.