ANY has to be after DIG, not at the end, but...
dig 2.0.0.127.zen.spamhaus.org. any
; <<>> DiG 9.16.30-RH <<>> 2.0.0.127.zen.spamhaus.org. any
;; global options: +cmd
;; Got answer:
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id: 16710
;; flags: qr rd ra; QUERY: 1, ANSWER: 5, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 4096
; COOKIE: 8f85b18f84bef09b0146215782efc3bbe53357f6b72a0ee4 (good)
;; QUESTION SECTION:
;2.0.0.127.zen.spamhaus.org. IN ANY
;; ANSWER SECTION:
2.0.0.127.zen.spamhaus.org. 60 IN TXT
"https://www.spamhaus.org/query/ip/127.0.0.2";
2.0.0.127.zen.spamhaus.org. 60 IN TXT
"https://www.spamhaus.org/sbl/query/SBL2";
2.0.0.127.zen.spamhaus.org. 60 IN A 127.0.0.10
2.0.0.127.zen.spamhaus.org. 60 IN A 127.0.0.4
2.0.0.127.zen.spamhaus.org. 60 IN A 127.0.0.2
;; Query time: 254 msec
;; SERVER: 10.53.53.100#53(10.53.53.100)
;; WHEN: Sun Aug 07 09:52:59 EDT 2022
;; MSG SIZE rcvd: 239
2.0.0.127.zen.spamhaus.org. 3579 IN A 127.255.255.254
^^^^^^^^^^^^^^^^
@ https://www.spamhaus.org/faq/section/DNSBL Usage
"If any of the tests return 127.255.255.254 then your queries (and very likely those of the
mail server) are being blocked ("ACL'd") because the DNS resolver being used is an open
public resolver. Some mail servers mistakenly reject all mail due to that 127.255.255.* return
code. This can be resolved by changing how your mail server queries Spamhaus DNSBLs."
