Hi Mark, 

In the upcoming major release, we've made some great improvements for RBL/URIBL handling. In the current public build, I do believe there is a timeout in place. But it cycles through each RBL/URIBL one at a time. In the upcoming release, we shotgun the RBL/URIBL requests all at once and take the responses after 5-10 seconds, effectively implementing a timeout for all at one time. 

21671 and 32412 milliseconds are indeed fairly high response times. Ideally, you want to stay under a second (1000 ms), especially for any RBLs that are doing Inbound SMTP blocks, since the SMTP session is so time-sensitive. For these two RBLs, I think it would be alright to remove them from spool and inbound SMTP filtering. McAfee has been removed as a default RBL in the next release, and we don't use SURBL in-house either.