I use SpamAssassin. It’s fine, but definitely needs training. I might look into migrating to rspamd as it seems better, but I don’t have time atm.