ok I give up, use the spamhaus list even though it has problems

mailsrv/assets/postfix/main.cf.part

@@ -80,10 +80,10 @@ smtpd_client_restrictions =
 # check if sender meets SPF policy for its domain
         check_policy_service unix:private/policy-spf,
 # reject clients from lists of known spammers
-#        reject_rbl_client zen.spamhaus.org,
-#        reject_rhsbl_reverse_client dbl.spamhaus.org,
-#        reject_rhsbl_helo dbl.spamhaus.org,
-#        reject_rhsbl_sender dbl.spamhaus.org,
+        reject_rbl_client zen.spamhaus.org,
+        reject_rhsbl_reverse_client dbl.spamhaus.org,
+        reject_rhsbl_helo dbl.spamhaus.org,
+        reject_rhsbl_sender dbl.spamhaus.org,
         permit
 
 ### Misc ###