We know that routers do not forward broadcast messages. So when a DHCP relay router receives a DHCP Discover message, the destination IP address is going to be 255.255.255.255 because at this stage the client does not know the DHCP Server's IP address. So why does the router not drop the packet? How does it forward the packet to the server? Since my understanding is that the router will see layer 3 and drop it since it saw a broadcast address.
The DHCP relay agent (router, or otherwise) creates a unicast DHCP request for the DHCP server(s) configured in the relay agent. The DHCP server replies to the relay agent, which then sends the response back to the requester.
You can see all the details of how this works in RFC 2131, Dynamic Host Configuration Protocol, which explains that DHCP relay inherits the BOOTP relay.
DHCP relay is not a routing function, even if it is usually activated on a router, but it's also used on switches (L2 and L3). You should see the relay agent as a network service like the DHCP server itself. In fact, it's more like a proxy than a routing function.
DHCP relay can't just forward the bare discovery, but needs to change several DHCP fields to enable proper handling by the DCHP server. Most often option 82 is also inserted to provide further information about the relay agent (
remote-id) and the interface the client is located on (