I'm an ISP, and mails from our dialups are hitting RCVD_IN_DYNABLOCK.

If you're running SpamAssassin as an ISP, your dialup pools may be listed in the Dynablock list.

The purpose of this blocklist is to list IP addresses that should not be sending mail directly to another server, without passing through a "smarthost" outgoing relay. In this case, your host is the "smarthost" – but it's also where SpamAssassin is running. So even if your customers are doing the "right thing", relaying via your host, they'll get hit – because as far as SpamAssassin can tell, a mail from a Dynablock-listed IP address is being sent to the scanner, without passing through a "smarthost" on the way. It doesn't know that they're your dialup pools.

The way around this is to get SpamAssassin to "trust" the dialup IP pool's addresses, so that they're exempted from the Dynablock test. e.g., if your dialup pools use the IP range 10.222.111.0-255, add this line:

trusted_networks 10.222.111/24

in /etc/mail/spamassassin/local.cf .