I know I've solved this before, but on a new install of 3.0.2 I'm finding messages getting tagged as RCVD_IN_SORBS_DUL, even though I'm pretty sure SA is supposed to ignore the first hop for that by default. It's not ignoring it, though.
If SA isn't skipping the first hop, you probably have a NATed mailserver and need to manualy configure your trusted_networks setting.
Other symptoms of this problem include spam that matches ALL_TRUSTED, and failure of whitelist_from_rcvd to match reliably.
