Whitelists aren't really practicaly on big setups. You need to block a lot before they even get as far as talking TCP. If you can manage a decent job with that, RBLs can prune enough of what's left for spamassassin and virus scanners to be able to cope with the minute amount of mail that is actually deliverable. It is not all that uncommon to see the spam:ham ratio of around 250:1. When you have a system handling mail for half a million domains, well, you get the idea.