A Belgian DNSBL built for clarity and restraint.

# main.cf: observe first
smtpd_recipient_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_destination,
    warn_if_reject reject_rbl_client dnsbl.ibcsc.be

# ACL: expose a scoreable signal without rejecting
warn  dnslists = dnsbl.ibcsc.be
      set acl_m_ibcsc_dnsbl = 1
      add_header = X-IBCSC-DNSBL: listed by $dnslist_domain ($dnslist_text)

# Feed acl_m_ibcsc_dnsbl into your local spam score. Do not deny here.

# local.d/rbl.conf: create a symbol, then tune its score locally
rbls {
  ibcsc {
    symbol = "RBL_IBCSC";
    rbl = "dnsbl.ibcsc.be";
    checks = ["from"];
  }
}

# RFC 5782 self-tests: run both before enabling rejection
dig +noall +comments +answer A 2.0.0.127.dnsbl.ibcsc.be
dig +noall +comments +answer TXT 2.0.0.127.dnsbl.ibcsc.be
dig +noall +comments +answer A 1.0.0.127.dnsbl.ibcsc.be

# Expected:
# 2.0.0.127: an A answer in 127.0.0.0/8 and an explanatory TXT answer
# 1.0.0.127: status NXDOMAIN
# SERVFAIL or timeout: no verdict; never accept or reject on that result
# If either control fails, do not use the zone for policy decisions