I would suggest using a known TLD. I could imagine SpamAssassin or another product, if they don't already, including optimisations to avoid querying on things that *look* like URLs but
can't possibly
be; and putting in a special case for SURBL would be a bit silly if we can avoid it.
That was my inclination too. A real TLD with a fake domain should be the most "standard"... for an obscured domain. :-)
Then, my suggestion would be something inside the surbl domain. Otherwise there is a risk (albeit remote) that someone could register the domain and have a problem.
sheesh...I don't see why this is still being debated. It seems pretty obvious that example.com is a bad choice, and that a TLD within the surbl domain would be better a better test point. Now just pick one and announce it. Next please...