The problem with Unified SPF

And to followup:

1a. Even if using the same record for HELO as for other identities
    provides an acceptable level of assurance (which will only ever be
    the case when the record ends -all) sharing a complex SPF record
    will probably result in far more DNS queries to reject a forged
    HELO than would be necessary if a separate record (of whatever
    syntax) were used for this purpose.

    -roy