Other way around. You just ask for the replies and it just sends the ones it hasn't filtered for being out of network, your client can keep an updated white-list to do one last step of filtering.

For DMs, (which haven't gotten spammy for me yet..) the sender can send it with a permission slip signed by the recipient. Any relay seeing a message without the signed permission gets dropped. Distribution of said permission is admittedly a problem. But you might be able to chain it. I send permission to my follows to message me up to n=3 then their follows can request it and send it along with the intermediaries permission to contact. Kind of like tls cert chains I guess.