Spamassassin with a 7.5 threshold and other measures like DMARC checks has worked surprisingly well for me in recent years.