I have the following ACL with Exim4:
acl_check_rcpt:
deny message = DNSRBL Access denied - $sender_host_address \
listed by $dnslist_domain\n$dnslist_text
dnslists = zen.spamhaus.org : b.barracudacentral.org
This applies the DNSBL to all mail, but I'd like to add an exception to only check incoming mail (or to skip the checks for mail delivered via an SMTP-authenticated session).