Recently I had some spam on internal distribution lists.
That was too bad, because it was a first class credit card fake :-)
So I searched and found a simple way to only allow domain sender address to send email to distribution lists.
That solved my problem.

Here is how I did it:

zmprov modifyConfig zimbraMilterServerEnabled TRUE
zmmilterctl restart
zmmilterctl status

ZDOMAIN=mydomain.ch
zmprov gadl $ZDOMAIN | while read dl_email
do
   echo "---- deny all senders to $dl_email"
   zmprov grr dl $dl_email pub -sendToDistList
   echo "---- allow $ZDOMAIN senders to $dl_email"
   zmprov grr dl $dl_email dom $ZDOMAIN sendToDistList
done

zmmtactl reload

This is a good site to read more details:

https://wiki.zimbra.com/wiki/Enabling_and_administering_the_Zimbra_milter