What is the XML rule for Veto if dest-dn is empty?

<rule>    <description>Veto if dest-dn is empty</description>    <comment xml:space="preserve">Add/ modiy operations in subscriber may result in many related ServiceNow Object manipulation. This policy ignores many such objects add-association operations from ServiceNow.</comment>    <conditions>        <and>            <if-operation mode="nocase" op="equal">add-association</if-operation>            <if-dest-dn op="not-available"/>          </and>      </conditions>    <actions>        <do-veto/>      </actions>  </rule>