You are (probably) validating passwords wrong

You are a security concious developer and you follow the advice given by security folks to have strong password requirements, and you set a rule of having at least 10 characters, containing one uppercase, one lowercase letter, at least one digit and special character. Surely, this will result in strong passwords, right?