I'm scratching my head too as spamhaus does seem to be working just fine. I know zip about Postfix and even less about Zimbra so it's certrainly possible and even likely that I'm just doing something dumb here.
[root@security backup-rsync]# dig 40.56.209.64.zen.spamhaus.org
; <<>> DiG 9.2.4 <<>> 40.56.209.64.zen.spamhaus.org
;; global options: printcmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 47341
;; flags: qr rd ra; QUERY: 1, ANSWER: 1, AUTHORITY: 23, ADDITIONAL: 2
;; QUESTION SECTION:
;40.56.209.64.zen.spamhaus.org. IN A
;; ANSWER SECTION:
40.56.209.64.zen.spamhaus.org. 900 IN A 127.0.0.3
;; AUTHORITY SECTION:
zen.spamhaus.org. 69885 IN NS 5.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS 8.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS a.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS b.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS c.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS d.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS f.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS g.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS h.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS i.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS k.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS l.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS m.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS o.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS q.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS r.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS s.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS t.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS x.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS y.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS 0.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS 1.ns.spamhaus.org.
zen.spamhaus.org. 69885 IN NS 3.ns.spamhaus.org.
;; ADDITIONAL SECTION:
0.ns.spamhaus.org. 12287 IN A 204.16.254.40
0.ns.spamhaus.org. 12285 IN AAAA 2001:7b8:3:1f:0:2:53:2
;; Query time: 149 msec
;; SERVER: 69.30.0.200#53(69.30.0.200)
;; WHEN: Tue Oct 27 10:51:00 2009
;; MSG SIZE rcvd: 478
[root@security backup-rsync]# |