Custom spam rules

what is proper way to add custom spam rules?
I created file
/etc/spamassassin/66_blacklist.cf
and insert there
blacklist_from *etmailservices.com
and did
systemctl restart spampd

But still, that particular rule is not working

Return-Path: <bounce-WCC4YC4TXMMUXCO322WGPH6QCE.500018@bounce.i.s50.etmailservices.com>
........
X-Spam-Report: 
	* -0.0 RCVD_IN_DNSWL_NONE RBL: Sender listed at
	*      https://www.dnswl.org/, no trust
	*      [161.71.34.73 listed in list.dnswl.org]
	* -1.9 BAYES_00 BODY: Bayes spam probability is 0 to 1%
	*      [score: 0.0000]
	*  2.0 DMARC_FAIL_NONE DMARC check failed (p=none)
	* -0.1 SPF_PASS SPF check passed
	*  0.0 SPF_HELO_NONE SPF: HELO does not publish an SPF Record
	*  0.0 HTML_MESSAGE BODY: HTML included in message
	*  0.1 DKIM_SIGNED Message has a DKIM or DK signature, not necessarily
	*       valid
	* -0.1 DKIM_VALID Message has at least one valid DKIM or DK signature
	*  1.4 PYZOR_CHECK Listed in Pyzor
	*      (https://pyzor.readthedocs.io/en/latest/)
	*  0.0 LOTS_OF_MONEY Huge... sums of money
	*  0.0 T_KAM_HTML_FONT_INVALID Test for Invalidly Named or Formatted
	*      Colors in HTML
X-Spam-Score: 1.4

in other hand, when I do
spamassassin -t < test.msg
rule is working

Content analysis details:   (100.5 points, 7.0 required)

 pts rule name              description
---- ---------------------- --------------------------------------------------
-0.0 RCVD_IN_DNSWL_NONE     RBL: Sender listed at https://www.dnswl.org/,
                             no trust
                            [161.71.34.73 listed in list.dnswl.org]
 0.0 USER_IN_BLOCKLIST      From: user is listed in the block-list
 100 USER_IN_BLACKLIST      DEPRECATED: See USER_IN_BLOCKLIST
-1.9 BAYES_00               BODY: Bayes spam probability is 0 to 1%
                            [score: 0.0000]
-0.1 SPF_PASS               SPF check passed
 2.0 DMARC_FAIL_NONE        DMARC check failed (p=none)
 0.0 SPF_HELO_NONE          SPF: HELO does not publish an SPF Record
 0.2 HEADER_FROM_DIFFERENT_DOMAINS From and EnvelopeFrom 2nd level
                            mail domains are different
 0.0 PP_MIME_FAKE_ASCII_TEXT BODY: MIME text/plain claims to be ASCII
                             but isn't
 0.1 DKIM_SIGNED            Message has a DKIM or DK signature, not necessarily
                            valid
 0.0 LOTS_OF_MONEY          Huge... sums of money
 0.1 DKIM_INVALID           DKIM or DK signature exists, but is not valid
 0.0 T_MONEY_PERCENT        X% of a lot of money for you

where is the problem then?

Is etmailservices also in the from field?