I was pulling my hair out over this one for a good half a day, reading and re-reading configuration file options at the spamassassin wiki
My problem was that 99 times out of 100, all of the dns blacklist tests were failing with a timeout error.. increasing the timeout to 90 seconds didn't help either... strangely, sometimes one or two of the tests would succeed
NS only uses the first nameserver in /etc/resolv.conf BUT setting it to anything other than localhost results in failed tests... I tried all of my nameservers seperately, as the first nameserver in the resolv.conf file, but always it was failing for me with timeout errors... yet if I did a DIG using my specified nameserver the response was returned very quickly, so it was baffling to say the least...
Set your first nameserver to 0.0.0.0
Once I made this change every check is running successfully and in less than 1 second