diff --git a/data/conf/rspamd/local.d/composites.conf b/data/conf/rspamd/local.d/composites.conf
index f4412086..a53b4871 100644
--- a/data/conf/rspamd/local.d/composites.conf
+++ b/data/conf/rspamd/local.d/composites.conf
@@ -34,3 +34,6 @@ FORGED_W_BAD_POLICY {
   expression = "( ~g+:policies | ~R_SPF_NA) & ( ~FROM_NEQ_ENVFROM & ~FORGED_SENDER )"
   score = 3.0;
 }
+RBL_EXCLUDE_FWD_HOST {
+  expression = "-WHITELISTED_FWD_HOST & ^g:rbl"
+}
diff --git a/data/conf/rspamd/local.d/rbl_group.conf b/data/conf/rspamd/local.d/rbl_group.conf
index 2dc9486d..21682dcd 100644
--- a/data/conf/rspamd/local.d/rbl_group.conf
+++ b/data/conf/rspamd/local.d/rbl_group.conf
@@ -45,4 +45,8 @@ symbols = {
     score = 2.0;  
     description = "List of networks hijacked from their original owners, some of which have already used for spamming.";  
   }
+  "RECEIVED_SPAMHAUS_XBL" {
+    weight = 0.0;
+    description = "Received address is listed in ZEN XBL";
+  }
 }