It's your loopback filter--try adding this. I don't have a dhcp server to test with but I think return traffic is directed to the dhcp client so you shouldn't need a filter for the return. If you do it should be pretty easy to add. I do see relay counters increasing after adding this term.
firewall {
family inet {
filter loopback-protect {
...
term allow-dhcp {
from {
source-address {
0.0.0.0/32;
}
destination-address {
255.255.255.255/32;
}
protocol udp;
destination-port 67;
}
then accept;
}
}
}
}