We filter out .xyz -- we have yet in two years to get an email from a legitimate company with a legitimate website that isn't a scam in one way or another on that TLD.
There are several others we block and haven't lost a minute of sleep.
Allowing several of those extensions would add hundreds if not thousands of spams a day that require additional filtering, when in reality 99.999% of them are all junk or scams.
MailEnable survivor / convert --