John Lyon replied:

> With the Confirm option. e.g.
> Send= Private,Confirm
> or
> Send= Editor,Hold,Confirm
>
> Set notebooks Private and Review=Owners to thwart address harvesting.


[log in to unmask] replied:

> push for the wide adoption of SPF (see http://spf.pobox.com)


Janice Frasche replied:

> Up until now, using the confirm mode was the usual built-in preventative
> option for spoofing.
> http://www.lsoft.com/manuals/1.8d/owner/owner.html#2.12.6


Pete Weiss replied:

> Recently on a staff list that I own here, I have implemented
>
> Send= Private,Confirm


As a result, my list configuration now reads:

> Notebook= Yes,.../archive/***,Weekly,Private
[...]
> Send= Private,Editor,Hold,Confirm
> Moderator= ALL,owner1,owner2,owner3
> Editor= owner1,owner2,owner3,(LISTNAME)


This meets two of my goals.

* Subscribers not set to REVIEW have to confirm their own posts.
* Subscribers set to REVIEW require Moderator confirmation to post.


To meet the remaining goal

* Non-subscriber posts are held for review by Moderators instead
  of being rejected.

would require removing "Private" from "Send=", correct?  Because the list
probably receives more spam attempts than non-subscriber post attempts (I
don't have recent data because the list has been set to "Send= Private"
for years), I think I'll leave "Private" in place.

Recarding SPF, because I'm not the site administrator, I'll simply forward
WBrown's advice to him.

Thank you very much for your advice, everyone!

--
Best regards,
Michael