Whitelist
Items added to the Whitelist let mails pass regardless of what any
other tests might result in.
You can add single mail addresses like joe@domain.com or pattern
like joe@*, *@domain.com or even joe*.com.
Blacklist
The Blacklist is the reverse to the Whitelist: no item passes, regardless
of what the tests might result in.
Hint: you might get the idea
to add sender addresses of known but missed spam to the blacklist.
This has two disadvantages: first the sender addresses change very
fast and second the blacklist will be filled with permanent useless
addresses (that slows down loading and checking and raises memory
consumption). Instead use a Quickfilter
and let it expire after 30 days.
Auto-Whitelist
If you get mail from certain senders on a regular base, this sender
will be put onto the Auto-Whitelist. This will speed up message procession
and avoid possible false positives. 
The Auto-Whitelist has a trigger to add user (X mails from this sender
within a certain number of days), an expire-age-setting for auto-deletion
and a never-add-to-auto-whitelist-list.
Auto-Whitelist addresses mail is send to
Everytime you write an eMail the addresses are added to the Auto-Whitelist.
So these recipients are never spam, if they write back to you. The
aging feature of the Auto-Whitelist prevents the list from growing
infinite.
Actually, if an item is on the White- or Blacklist, no other test is
done.
It is possible to add IP-numbers to white- and blacklists, too. IP-numbers
are not auto-whitelisted. But: a message normally has multiple IP-numbers
listed in its header and all are tested against the white- and blacklist.
So whitelisting 127.* for local IP-numbers might be an idea, but if
the spammer adds a fake IP-number 127.0.12.3 the spam will pass.