...

Note the use of your server's hostname, so that spammers cannot fake the data without knowledge of your server's header format and so on.

I'm not an ISP, but I do have a mail server on an RFC1918 address (10.*.*.*, 172.16.*.* or 192.168.*.*) and incoming mails are hitting RCVD_IN_DYNABLOCK.

SA 2.6x has a trust path bug where it will wind up over trusting if one of these IPs is in the path. It winds up trusting the ISP relay server and decides it's part of your network, and thus thinks the dialup user dropped off directly to your MX.

You can fix it by forcing SA to only trust one host as shown below (replace "192.168.1.1" with your mail server address):

  trusted_networks        192.168.1.1/32