Came here to say this could be trivially handled at the MTA. Lo and behold
> Emails sent from the .MIL domain to the .ML addresses “are blocked before they leave the .mil domain and the sender is notified that they must validate the email addresses of the intended recipients,"
