A general solution for SENDER checking is to configure list with ezmlm-gate(1). ezmlm-gate(1) takes as arguments any number of basedirs for subscriber lists. Posts from SENDERs that are found are posted. For others ezmlm-store(1) is invoked. If DIR/modpost exists, ezmlm-store(1) will send out other messages for moderation. To bounce such messages, create DIR/modpost, and use the ezmlm-gate(1) -P switch (will be passed on to ezmlm-store(1) to bounce any posts not from a moderator).
By default, ezmlm-gate(1) accepts messages from subscribers. However, this is overridden if any “basedirs” are put on the ezmlm-gate(1) command line. Common would be to create a address list and put its “basedir” on the ezmlm-gate(1) command line. Trusted email addresses can then be added with:
% ezmlm-sub basedir trusted@host
As this relies on SENDER checks it is less secure than the ezmlm-store based confirmation-requiring setup.