Recently I had some spam on internal distribution lists.
That was too bad, because it was a first class credit card fake :-)
So I searched and found a simple way to only allow domain sender address to send email to distribution lists.
That solved my problem.

Here is how I did it:

zmprov modifyConfig zimbraMilterServerEnabled TRUE
zmmilterctl restart
zmmilterctl status
zmprov gadl $ZDOMAIN | while read dl_email
   echo "---- deny all senders to $dl_email"
   zmprov grr dl $dl_email pub -sendToDistList
   echo "---- allow $ZDOMAIN senders to $dl_email"
   zmprov grr dl $dl_email dom $ZDOMAIN sendToDistList

zmmtactl reload

This is a good site to read more details: