Question about how to configure access_rules.

Because of some new anti-virus filtering that I'm doing, I now have a lot 
of messages that are ending up going to lists that are coming from 
MAILER-DAEMON@mydomain. They all end up coming to the list owners as 
consults.

I'd like to add the following to access_rules:

post
deny
@denylist


where denylist would be a sublist. My question is whether the rule should 
be added to the GLOBAL, DEFAULT, or to each of the individual lists.

I'd like this to apply to all lists.

Also, if I use GLOBAL or DEFAULT, should denylist be a sublist of GLOBAL 
or DEFAULT or should it be a sublist of each specific list?

I really hope I'm making sense asking this right. Anyone?

TIA

-- 
Time flies like the wind. Fruit flies like a banana. Stranger things have  .0.
happened but none stranger than this. Does your driver's license say Organ ..0
Donor?Black holes are where God divided by zero. Listen to me! We are all- 000
individuals! What if this weren't a hypothetical question?
steveo at syslang.net