There is one more problem:

Axigen -> DNS Check
use Reject message if originator's domain has no MX entry
use Reject message if the originalting IP has no reverse DNS entry

If i use this two rules, they work as ALL conditions(not ANY conditions), that is wrong.
it is possible to make so that checked the MX record first and then checked reverse DNS,
and if MX record pass then don't checked reverse DNS.
Because not always MX record = A record in DNS

That is Reverse DNS has to be included only for entering connections or has to exclude local connections