The TLS/SSL and DNS carveouts are pretty normal. There are a million security options for those services and enabling them all would often mean denying access to anyone running a browser/client more than a few weeks old. Documenting them all would be a PITA so most policies simply prohibit them entirely.
Testing against customers is also a common prohibition for obvious reasons.
Testing against customers is also a common prohibition for obvious reasons.