I'm using a custom procmail setup build over the years around Bogofilter [1]. I find it still works well, even though Bogofilter is more or less unmaintained at this point. I'm only aware of one serious bug in the upstream distribution [2], but a patch for that exists.

The running yearly average false negative rate for me is currently 6.5%, which isn't perfect but it's survivable. It's hard to say what false positive rate is, but over the years I can't remember an instance where I would go fishing in the spam folder for a mail I knew I should receive (I do have classification settings very much biased towards false-negative rather than false-positive)

[1] http://bogofilter.sourceforge.net

[2] https://bugs.debian.org/cgi-bin/bugreport.cgi?bug=733622

I use a methodology called S25R [1] that involves regex filters in postfix. Super simple, no third party anything for those regex patterns. I reject the spammers and use iptables for the really bad spammer networks. In terms of external third party resources, I also use spamcop and uceprotect in postfix to do RBL checking.

[1] - http://www.gabacho-net.jp/en/anti-spam/anti-spam-system.html

I use dspam. It seems like an abandoned project, but it still works. I looked at rspam, but I'm not a fan of the way the lists cost money as soon as you want to make money. Sure, right now, I'm only hosting personal email, but who knows what could happen in the future?

I use mailcow[1], which uses rspamd and it just let's through like 1 mail every few days.

[1]: https://github.com/mailcow/mailcow-dockerized/

I can thoroughly recommend rspamd - it feels rather more robust than spamassassin and is easier to configure eg if you just want to do Bayesian filtering etc. The analytics and logging you get through the web interface is also very good.

I've been having good luck with SA's heuristic learning engine. False positives are non-existant and it catches ~90% of spam that isn't caught by other rules first.