I have trouble making my squid-conf exclude a website:

I use first

acl forbidden dstdomain .nytimes.com

Then

http_access allow allowed_hosts
http_access deny forbidden
http_access deny all

But forbidden is not excluded. These three are the only filter-lines in the
conf-file.

Why will this not work?