I used to work at a smallish mom-and-pop website host (do those even exist anymore?) that also offered email services. Our PF firewall just straight-up blocked huge swaths of IPv4 CIDRs because it was 99% email spam and exploit scanners. We had no ability whatsoever to fight it any other way. I don't recall even a single complaint from any of our customers.