I had some more thoughts about the "refuse" replies.
I mentioned the possibility of setting dns_block_time in SpamAssassin higher than the default 300 seconds, but on a second look I saw that dns_block_time is used for all dnsbl block rules, with no ability to set it differently for just dnswl. So I would not want to change the setting.
However, what about increasing the TTL on the 127.0.0.255 A record to more than the current 3600? That would cause the nameservers that are being blocked with "refuse" to cache their results for longer, further reducing the load on your nameserver by a factor of however many hours you set it to. You already tell people who purchase a new subscription to expect it to take hours for the result to propagate. It should be fine to make the time that much longer for the one time event of a new subscription by giving it a big TTL.
Sidney
