Here are the test results.
OK, understood.
If I understand correctly, with a straight smtpd rejection the decision is made entirely by the cloud service, which can lead to false positives.
The NS8 Postfix configuration is intentional: Rspamd computes a score that combines several factors (DNSBLs, Bayes, SPF/DKIM/DMARC, and so on). Messages scoring above 6 are flagged as spam and delivered to the Junk folder, and only messages above 12 are rejected at SMTP time. This way, rejection happens only when there is strong evidence, and borderline cases stay under the user’s control.
Perfect.
That’s why we can’t rely on spamhaus’s test results to determine if the configuration is working or not @Nuke ! 
I’m not sure I quite understand that. Prior to migrating to NS7 (and NS8 last year), I used ClearOS with Spamhaus smtp filtering in postfix. I remember setting up the postfix config with spamhaus and I think perhaps Baracuda and maybe one other. I didn’t have rspamd running but I also didn’t have any spam and next to no missing emails. I also remember having to do something for Outlooks since Exchange isn’t following standard smpt. I’d like to have postfix check and not even accept spam email before it gets to rspamd. Why process an email when it is already from a site known to send spam?