This mostly better option for rbl dnsbl list is missing in POSTFIX configuration for example .
POSTSCREEN and POSTGREET am i missing some and are those in the GUI configuration ?
For example, the equivalent config of
in postscreen terms is
postscreen_dnsbl_sites = sbl-xbl.spamhaus.org, bl.spamcop.net
postscreen_dnsbl_action = enforce
Some consideration where you put rbl check, smtpd_*_restriction or postscreen
Check before any SMTP transaction because the input was only IP address
Use Caching mechanism when IP address doesn't found in RBL
Support weighted score for dnsbl site (for example your internal RBL was more trusted than spamhaus RBL, then you can put postscreen_dnsbl_sites = internal.rbl.example.com*3, spamhaus.org)
Weight can be negative value to get same effect with permit_dnswl_client