Start with a couple of really good DNSRBLs and then add SPF checking.
Also, make sure your host isn't an open relay using the various tools around the Internet. 'fail2ban') that will automatically block IP addresses at the 'iptables' level for a deterministic amount of time when they attempt to log into hosted services and fail repeatedly.
This approach lets automated software handle blocking of bad mail at the originating source that you never really wanted to get in the first place - and will block the *spam in the process while letting legitimate mail through.
Your answer tells us whether most spam is from Russia.That is the answer to a completely different question, and does not help at all in answering OP's question.It could very well be the case that most spam comes from Russian mail, but most Russian mail is not spam; or, it could very well be that comparatively little spam comes from Russia, but most mail from Russia is spam anyways. Server-side filters for mail are a much better solution.Russia is the 9th largest country population wise in the entire world so it may be quite a big deal to block it.I would look at the spam designated to you and see if you can identify any common denominators in the headers or content of the spam.
There may very well be other ways to distinguish between the spam and no spam than blocking everything. The percentage we're interested in is the percentage of Russian mail that is spam (though even that might be irrelevant).However, the percentage of spam that is Russian mail has absolutely nothing to do with [email protected]: You still don't seem to get it: this has nothing to do with language vs origin. Maybe according to your mail servers you can assume this, but overall only 4.9% of total spam comes from Russia according to Trustwave.According to Securelist the number is as low as 1.7% for January 2012.See this picture for how far down Russia is placed on the spam list: Edit: additional info.If you sometime have to do business with a Russian you would have a bug that may be hard to identify later on, perhaps in a couple of years when you forgot about this configuration.