You don't. Spam is the cost of business. You accept it because being over-protective of your email address means risking losing valuable email from legitimate correspondents. You want every click on your email address to work for legitimate senders, so that means you suffer illegitimate senders, too.

By the way, twenty spam emails a day is a tiny amount. My email accounts see hundreds a day after no-duh filtering.

you have a very high HN karma - kudos. is it that you have it hosted on a server vs a provider such as Microsoft and Google or even Proton?

I use mailcow self hosted, which allows for fine tuning. I have a list of recipients I trust, and that goes in mailbox, next is a folder for unqalified mail, and finally 100% spam.

I do use SpamSieve on macOS for additional client-side spam-filtering, which helps. But I don't want to stress: no spam solution should ever just discard email without you being able to review it. None of them are good enough for that. I have delegated accounts in Gmail that years in Google still every day has false positives. It's a lot of email that would just vanish if I trusted server-side spam filters enough to never let it see my inbox.

20 per day is less than 5 minutes. Most of my spam comes from GMail. Blacklist GMail for the minor annoyance that messages that get through spamassassin, dkim filtering, greylisting, etc for?