Why do I keep getting spam from blacklisted domains?

Why do I keep getting spam from blacklisted domains?

I have blacklisted many domains at the organisation level.
Yet users continue to receive spam from these domains.
An example would be "pensionlawyers.com" which is a repeated spammer.
This is in the blacklist of domains at the domain level in organisation settings.
All user level whitelists have been removed (so there is no conflict) and yet this still occurs!
Why oh why does zoho have such a buggy spam system?

When changes are made to whitelists and blacklists how long does it take for the zoho system to start acting on these changes for:
  • Domain: At the organisation level?
  • Email: At the organisation level?
  • Domain: At the user level?
  • Email: At the user level?
In addition a large percentage of emails that come in FAIL an SPF (Sender Policy Framework) check.
Why oh why are these not rejected with a bounce message to the sender?

There is little point having systems and standards to reduce spam if they are not acted upon by companies like zoho.