I can confirm that they don't work with DENY either.
I used the following settings to test it:
Code:
POLICY ACCEPT 2
DENY H .nl "Test"
A few minutes later, someone from .nl logs in.
11-10-2003 21:46:19 LOGIN: "ioB_Service" "xx" "donators" "Vote ioFTPD for president" "xx@xx.gelen1.lb.home.nl"