fix the DNAME rule

The inhibits flag is set by the negative match on the DNAME rule. I
suppose that means it should be a -1, but the idea was that it was
supposed to be bits, and -1 doesn't work with bits.  So there really
should be yet another set of flags in the rules - one to set the bit on
a positive match and the other to set on a negative match.  Do that when
it's needful.