That's a pretty hard question to answer without knowing a lot more about your situation. I've found that the combination of spamassassin 3 with the rulesets from
www.rulesemporium.com and the blacklist sbl-xbl.spamhaus.org, along with the SMTP protocol enforcement in exim works quite well at blocking spam. My setup blocks probably about 90% of spam from coming in and flags the another 8% or so, but there is still spam getting through untouched.
The spammers are getting much more clever, and getting that last 2% or 3% is going to take a lot more effort than the other 98%.
