Originally Posted by
mixture
Is that on sites where you take an Rsync feed from Spamhaus ?
If you're using their public DNS service, then you may be inadvertently caching somewhere along the lines .... either in your DNS resolvers or your anti-spam software.
Rsync users get updates every 60 seconds, so even modest caching of their public DNS service could be what's causing your false-positives.
It's public DNS but i've had them on the list for more than 24hrs straight and my filters reload their cache daily.