First, you want a local DNS resolver for RBL query, since most public DNS servers (such as google's) were blocked by multi-RBL providers.

Just install unbound as local resolver:

 $ sudo apt install unbound

Then, edit '/etc/resolv.conf' to update your nameserver to 127.0.0.1 only.

The next, test if unbound is working correctly or not, by implementing the following query.

 $ dig 184.255.169.193.zen.spamhaus.org

If you see the results include:

 ;; ANSWER SECTION:
 184.255.169.193.zen.spamhaus.org. 768 IN A	127.0.0.4
 184.255.169.193.zen.spamhaus.org. 768 IN A	127.0.0.11
   
 ;; Query time: 0 msec
 ;; SERVER: 127.0.0.1#53(127.0.0.1) (UDP)
 ;; WHEN: Sun Apr 30 08:14:42 HKT 2023
 ;; MSG SIZE  rcvd: 93

That should be OK at this time (04/10/2023).

If the result is NXDOMAIN, that seems your DNS resolver has some issues.

The next, let's enable postscreen as a SMTP proxy for smtpd. Edit the file '/etc/postfix/master.cf' to comment out this line:

 #smtp      inet  n       -       y       -       -       smtpd

This disables smtpd service.

And enable the following four lines:

 smtp      inet  n       -       y       -       1       postscreen
 smtpd     pass  -       -       y       -       -       smtpd
 dnsblog   unix  -       -       y       -       0       dnsblog
 tlsproxy  unix  -       -       y       -       0       tlsproxy

They enable postscreen as SMTP proxy, and two plugins DNS blocking and TLS proxy.

Now, let's edit file '/etc/postfix/main.cf' and add these lines:

 postscreen_access_list = permit_mynetworks cidr:/etc/postfix/postscreen_access.cidr
 postscreen_blacklist_action = drop
 postscreen_greet_action = enforce
 postscreen_dnsbl_threshold = 2
 postscreen_dnsbl_action = enforce
 postscreen_dnsbl_sites = zen.spamhaus.org*2

Here '/etc/postfix/postscreen_access.cidr' is just the file where our own IPs should be put. For example, IP for you secondary MX. The content looks like below.

 38.45.66.xx/32	permit
 38.45.64.xx/32	permit

And, here we are using spamhaus as DNS RBL only. Spamhaus's weight is set to 2, DNSBL threshold is also 2. That means when client IP hits spamhaus, it will be disconnected.

Since we have changed DNS resolver and updated postfix configuration, it's better to restart related services.

 $ sudo systemctl restart postfix dovecot opendkim

Now let's watch the logs, we will see the blocking results soon like follows.

 Apr 30 08:27:16 mxin postfix/dnsblog[78356]: addr 121.226.108.148 listed by domain zen.spamhaus.org as 127.0.0.3
 Apr 30 08:27:16 mxin postfix/dnsblog[78356]: addr 121.226.108.148 listed by domain zen.spamhaus.org as 127.0.0.11
 Apr 30 08:27:16 mxin postfix/dnsblog[78356]: addr 121.226.108.148 listed by domain zen.spamhaus.org as 127.0.0.4
 Apr 30 08:27:16 mxin postfix/postscreen[78355]: DNSBL rank 2 for [121.226.108.148]:49837
 Apr 30 08:27:22 mxin postfix/tlsproxy[78359]: TLS handshake failed for service=smtpd peer=[121.226.108.148]:65458
 Apr 30 08:27:22 mxin postfix/tlsproxy[78359]: DISCONNECT [121.226.108.148]:65458

As you see this IP 121.226.108.148 who hits spamhaus was blocked by postscreen.

The last, if you have other DNSBL checks like follows,

 smtpd_recipient_restrictions =
    permit_mynetworks,
    permit_sasl_authenticated,
    reject_unauth_destination,
    reject_rbl_client zen.spamhaus.org,
    reject_rbl_client bl.spamcop.net

Please comment them out:

 #   reject_rbl_client zen.spamhaus.org,
 #   reject_rbl_client bl.spamcop.net

It should not make both smtpd and postscreen to double check DNSBLs.

Here is the docs for postscreen you should read carefully.

Postscreen Howto