Adding my disagreement to the chorus— the number of permutations they try on my personal domain is not high enough to warrant an explicit allowlist. I actually don't even have a blocklist; I simply don't receive that much spam.

Most of it comes to two addresses which are public via git (one from commit logs, the other explicitly stored in a repo).