I've been using a combination of
mail/spamd and
mail/rspamd for several years now, but I also used spamassassin for many years.
The former one needs to be fed with an extensive whitelist of "known stupid" mailproviders that don't adhere to the RFCs and re-send from different IP addresses, otherwise those will never pass greylisting. Other than that, it can be pretty effective and fends off a large amount of typical 'one off' spamservers.
TBH - in minimal configuration just running on its own without any other input, greylisting more often gets in the way of legitimate mail than most people are willing to tolerate. But if you feed the black- and whitelists with some pf-rules and scripts, it becomes a valuable tool in the chain. E.g. any server we sent mail to more than once is whitelisted, prefixes from some notorious spamhosting providers like OVH are regularly updated (whois.radb.net is great for this!) and added to the blacklist etc...
rspamd on my servers usually runs with rbl, clamav, bayes, neural and some other enabled modules depending on the use-case and number of domains/users on the server and also performs quite well, even in larger setups.
Dovecot/sieve also passes mail for ham/spam learning to rspamd when users move mail to or out of their Junk folders for training - this is IMHO the most important and valuable source of training data. There are some example configurations on github or in various blogs for this - searching for "dovecot rspamd learn spam" will yield enough results to get an idea of the mechanism so one can adapt it to their needs (as I did).
rspamd also handles (among other things) the dkim-signing of outgoing and checking of incoming mail, and sadly also needs an ever-increasing whitelist of maildomains managed by incompetent inbreds that are worse at sending mail than 99% of all spammers out there...
(e.g. a subsidiary of a large international car manufacturer regularly sending mails for domain abc.com, mailserver in domain abc-def.com, headers have <from> def.com and <reply-to> def-abc.com, their mails often only consist of a large image and a link to abc.net and they never heard of SPF or DKIM - their mails repeatedly reach the highest-ever scorings I've ever seen...)
rspamd is a beast to configure though if you want to really make use of its features. It's basically a pile of various filters, scripts and programs thrown together and this shows at various places - especially the hideously scattered configurations and their wildly varying syntax. Other than that, combining multiple methods to obtain a 'large picture' IMHO is the right approach and it works, so it pays to bite through the initial config and improve it over time. The basic setup and enabled filters is already a good starting point, so there's not that much head-butting involved in just getting it to run. Once you have a good working rspamd setup and training database, you should hold on to it with dear life and back it up with your other "most valuable data". (although, for the training data that's only until they again make breaking changes to the database format and their migration script doesn't work...)
As
freezmi already pointed out: the web interface for rspamd is quite nice - a lot of statistics and a browseable log with detailed information on the scoring of all mail that came through.
MWL did a pretty good job with explaining rspamd, its configuraiton and training via dovecot/sieve (and pretty much everything else regarding a secure, modern mail server) in his book "Run Your Own Mailserver". I can highly recommend that book! I've been running mailservers for 20+ years now and still found valuable information and new viewpoints in it.
