milter-greylist not blacklisting

I have the following set in /usr/local/etc/greylist.conf:

racl blacklist domain /.*\.cn$/

but I am still seeing messages delivered after greylisting:

Return-Path: <reportfjgiirsy@service.imrmyih.cn>
Received: from service.imrmyih.cn ([160.30.55.96])
Received: from 263.com (43.164.135.245) by service.imrmyih.cn ... (envelope-from <reportfjgiirsy@service.imrmyih.cn>)
From: "visajapan" <reportfjgiirsy@service.imrmyih.cn>
Message-ID: <20250919045636803510@service.imrmyih.cn>
X-Greylist: inspected by milter-greylist-4.6.4 ... for IP:'160.30.55.96' DOMAIN:'[160.30.55.96]' HELO:'service.imrmyih.cn' FROM:'reportfjgiirsy@service.imrmyih.cn' RCPT:''
X-Greylist: Delayed for 00:30:07 by milter-greylist-4.6.4

The blacklist domain lines appear before the greylist.conf line adding the
X-Greylist header, although I've also tried placing them after it.

Any ideas why this might be happening?
I've tried blacklisting both "domain" and "from"
I have no statements of the form:

racl greylist list "grey users" delay 30m autowhite 3d
racl whitelist default

as I want greylist for everyone by default.

Thanks,

Gary