I am adding those listings on the new server to the file /usr/share/spamassassin/60_whitelist.cf.
I forgot a few:
4) do not edit files in /usr/share/spamassassin unless you REALLY know what you are doing. These files are considered to be a part of spamassassin, and will be obliterated without prompts when you upgrade. Also, if you screw up one of these files, it's hard to get your SA back to a working state without reinstalling.
Define your whitelists, etc in /etc/mail/spamassassin/local.cf instead. If you screw up, you can always remove it and be right back to an "out of the box" config.
(note: any duplicate settings in local.cf will clobber the existing settings in /usr/share when spamassassin starts up and reads the configuration files. So yes, you really can configure anything you need here.)
5) don't forget to run spamassassin --lint after editing any configuration files.
