I am in the 4.5.4.
The correct key if of course the FQDN. My problem was with the new hosts (where the rule
was not applied for some reason).
I removed all rules and started from scratch (and I did an ipactl restart in the meantime)
and then it worked.
Many thanks for the --all/--raw