When there is a DNS timeout, SpamFilter will skip the specific dns query that timed out and will continue with the next query/filter - so the email is not allowed thru right away as usually many more tests will be performed.

Having SpamFilter retry on DNS failures would be a rather potentially big problem. If the DNS server(s) SpamFilter uses are completely down, every single query may time-out. Having retries could mean that an email that would normally take 1 second to process may take 20-60 seconds to process as multiple timeouts need to be waited upon. This would create a potentially ever-growing queue up of incoming emails that could not be processed in time, which could bring the SpamFilter server to its knees.

In regards to the amount of timeouts, it is normal for a small percentage of incoming connections to contain DNS timeouts during the various DNS tests. As a reference, on our own logsat.com mail server yesterday we processed about 30,000 incoming connections, which resulted in about 400 DNS timeouts (one every 3.5 minutes or so).