It does have a white list and that works for me but that will be a pia to implement for all our other users.
Yep, we have an elaborate whitelist. There is no way around it, since we block big third-party marketing sites, like salesforce, constantcontact, hubspot, etc. 99% of their stuff is marketing spam. But some legit companies still decide to use those sites to send legit mail. So I have to find those and whitelist them, if I can. It takes significant time.
The problem is that it costs senders essentially $0 to send out billions of crap messages a day. And every company thinks it is their "right" to send you whatever crap they want, and as often as they want, just because you gave them your Email address to purchase something or to access some site. And they try to justify their crap by calling them "surveys" and "followup" and "newsletters." And they try to intentionally circumvent blocking by registering lots of different variations of their domain names for their mail servers. Oh, and despite their claims, they offer and sell lists from one purpose to others for other purposes.
ConstantContact even had the gall to send a US mail letter to my CEO, explaining why we shouldn't block their important messages to our business. He laughed.