Anti-spam cfg. for zen.spamhaus.org but IPs on SBLCSS still getting through

Hi:

I've cfg. an Exchange server to use IP Block List Provider zen.spamhaus.org but mail from IPs on the SBLCSS are still getting through.  From command prompt I've run nslookup x.x.x.x.zen.spamhaus.org and received proper 127.0.0.3 response so I know server can query Zen.  It's cfg. to 'Match any return code.'

Any ideas?

Thank you! 

Bob Herman IT Tropolis