Looks like I hit this bug -
Bug 11316 - postfix_recipient_restrictions.cf is missing some spamhaus entries.
Editing $ZIMBRA_HOME/conf/postfix_recipient_restrictions.cf and adding a line for zen.spamhaus.org solves the problem, and it is added correctly to the postfix conf.