How to block entire top-level domain?

See How can individual users configure spamassassin?

Simply create a filter:
For incoming mail: * matching all of the following rules

  • To . matches expression *.br
    … execute the following action
    Discard with message: - / or Delete Message