def rule(event):
    if all(
        [
            not event.deep_get("Z", default="") == 0,
            "." in event.deep_get("query", default=""),
            not any(
                [
                    any(
                        [
                            event.deep_get("query", default="").endswith(".arpa"),
                            event.deep_get("query", default="").endswith(".local"),
                            event.deep_get("query", default="").endswith(".ultradns.net"),
                            event.deep_get("query", default="").endswith(".twtrdns.net"),
                            event.deep_get("query", default="").endswith(".azuredns-prd.info"),
                            event.deep_get("query", default="").endswith(".azure-dns.com"),
                            event.deep_get("query", default="").endswith(".azuredns-ff.info"),
                            event.deep_get("query", default="").endswith(".azuredns-ff.org"),
                            event.deep_get("query", default="").endswith(".azuregov-dns.org"),
                        ]
                    ),
                    event.deep_get("qtype_name", default="") in ["ns", "mx"],
                    event.deep_get("answers", default="").endswith("\\x00"),
                    event.deep_get("id", "resp_p", default="") in [137, 138, 139],
                ]
            ),
        ]
    ):
        return True
    return False
