* Query domain
* QPS Limit total
* QPS Limit per IP address or subnet
+ * QClass (QClassRule)
* QType (QTypeRule)
* RegexRule on query name
* Packet requests DNSSEC processing
* a NetmaskGroupRule
* a NotRule
* an OrRule
+ * a QClassRule
* a QTypeRule
* a RegexRule
* a SuffixMatchNodeRule
* `NetmaskGroupRule()`: matches traffic from the specified network range
* `NotRule()`: matches if the sub-rule does not match
* `OrRule()`: matches if at least one of the sub-rules matches
+ * `QClassRule(qclass)`: matches queries with the specified qclass (numeric)
* `QTypeRule(qtype)`: matches queries with the specified qtype
* `RegexRule(regex)`: matches the query name against the supplied regex
* `SuffixMatchNodeRule()`: matches based on a group of domain suffixes for rapid testing of membership
* member `len`: the question length
* member `localaddr`: ComboAddress of the local bind this question was received on
* member `qname`: DNSName of this question
+ * member `qclass`: QClass (as an unsigned integer) of this question
* member `qtype`: QType (as an unsigned integer) of this question
* member `remoteaddr`: ComboAddress of the remote client
* member `rcode`: RCode of this question