Is this true: A Disawow file is not enough

I recognized a negative seo attack against 2 of my sites. They blasted thousands of links from like 100 domains.

To encounter the attack I created a disawow file and specified to disawow the whole domain. Iv'e done that several month before and thought that i was good to go but....

Now i just read that a disawow file may not be enough.

Unreliable Witness said:

Creating a disavow file is not enough. You need to get Google to recrawl all of those spam links so that it recognises that they are the ones you want to disavow.

Click to expand...

And by digging deeper i found this on a website:

Even if you are currently using h-ttps://www as your main site, you probably have links pointing to another version of your website, such as h-ttp://www. You technically have to upload the same disavow file to ALL versions of your website or you’re not disavowing everything properly. There are possibly several versions of your site:

h-ttp://
h-ttps://
h-ttp://www
h-ttps://www

In order to upload a disavow file to all versions, you’ll need to verify all of these versions of your site in Google Search Console. If you don’t upload a disavow file to all versions of your site, and even if you are redirecting from one version to another, links exist to your other version(s)…and they aren’t being disavowed. Google doesn’t automatically pass the disavow file over to the other versions.

Click to expand...

What is your opinion on that, Is this true?

Do I really have to make google crawl all of these spammy pages again (a lot of them don't even exist anymore) and do I really have to upload a disawow file for all versions?

Where I have disavowed links, I've done so on both the http and the https version of the site. You can use the same disavow file so it takes 30 seconds.

From what I've read (and I've done a lot of research on Penguin), Google updates its database when it recrawls the page with the link on it, not when it first reads your disavow file.

Just as an example, if you look at Link Research Tools as an example of a tool specifically written to help sites recover from Penguin, they have a tool dedicated to getting Google to recrawl links.

I've personally experienced a recovery of sorts when the links have been recrawled.

As posted in the other thread, the way I get Google to crawl links is to buy an expired domain with links to it, and on the home page, link out to the spam sites (say 50-100 at a time). Link your expired domain to Webmaster Tools / Search Console then request from there that Google indexes the home page. If you want to take it a level further, make the links on the home page links to URLs on the expired domain (e.g. mydomain.com?a=1, mydomain.com?a=2) and have those redirect to the spam pages. Then request that Google indexes the home page AND the linked pages. A couple of days later, change the links on the home page and repeat.

An expired domain with a few links to it helps indexing speed - I've found Google will index links on a site that has other links pointing to it faster than it will index a brand new domain.

You don't have to ask Google to recrawl the links. You could wait. But Google might take 6 months or more to recrawl low quality pages by itself.