The HELO domain should be checked if the return-path is empty. In most cases the HELO domain is different to the return-path domain, so a different SPF record is used. Roger