[autotypo]

Did the sender domains in question have SPF records at any point?

SPF is essentially a self-maintained whitelist.

Blacklists are public and searchable. Something to check after dealing with an infected machine, for example.

[strictnein]

> SPF is essentially a self-maintained whitelist.

Ironically, commercial spammers have the best SPF records. And DKIM. And all the other goodies.