DM REPLACES the config-managed DM allow entries. Absent or null leaves them alone; an empty list clears them. It never touches senders approved through pairing — a policy edit cannot revoke an approved pairing.
DMPolicy sets how direct messages are admitted: "pairing" (a person must be approved first), "allowlist" (only listed senders) or "open". Empty leaves it unchanged.