I also use greylisting along with XBL as sole spam control. But nowadays it's important to push it down the pipeline a little bit. For example if my MTA receiv

I also use greylisting along with XBL as sole spam control. But nowadays it's important to push it down the pipeline a little bit. For example if my MTA receives an email that has a valid hostname, spf is good, isn't on xbl, then it will accept it even if the sender is unknown. Soft bounce happens only when something is blatantly incorrect. I used to also check DKIM before accepting a mail but that forced my MTA to accept the SMTP DATA and I worry that some clients would not retry if the mail was rejected after DATA (even though they should, because "storage full" isn't uncommon for example). It ends up working well for me because most legitimate mail have all those things right, and most illegitimate mail have at least one thing wrong.