Editing Sender Policy Framework (section)

===HELO tests===
For an empty Return-Path as used in [[Bounce message|error messages]] and other auto-replies, an SPF check of the [[Simple Mail Transfer Protocol#SMTP transport example|HELO]] identity is mandatory.

With a bogus HELO identity the result NONE would not help, but for valid host names SPF also protects the HELO identity. This SPF feature was always supported as an option for receivers, and later SPF drafts including the final specification recommend to check the HELO always.

This allows receivers to allowlist sending mailers based on a HELO PASS, or to reject all mails after a HELO FAIL. It can also be used in [[reputation system]]s (any allow or deny list is a simple case of a reputation system).