We are using the csf RELAYHOSTS setting to prevent lfd from creating temporary firewall entries for customers who successfully check email. We are not on cPanel, so the setting isn't normally there, but it works perfectly once added. We have a separate daemon that maintains /etc/relayhosts with the IPs of recent successful connections.
The problem is that during a csf upgrade it seems to strip the RELAYHOSTS setting out of the configuration file. My suggestion would be during an upgrade to leave RELAYHOSTS setting in the config IF the /etc/relayhosts file already exists and contains an IP address at least on the first line of the file (proving it's in text format).
Thanks!