Sendmail 8.14.4 on CentOS 6.8 tcpwrappers problem

I am running a sendmail server on CentOS 6.8. For MTA connections on port25 I want to use tcpwrappers to reject host with no PTR DNS record. so my hosts.allow looks like : sendmail: ALL EXCEPT UNKNOWN My problem is the mail submission port on 587 seems to share this setting. The result is that roaming users (mostly on US Cellular) who don't have a PTR record for their current IP address get rejected before they can authenticate. I can fix this by setting up sendmail: ALL in hosts allow, but this about triples the number of garbage connections from spammers on port 25. Does anyone know a way to make sendmail call libwrap for port 25 connections but not for port 587 connections that will be authenticated ? Thanks!