Fixed generated rules for blanket domain deny