Thanks for this attempt, but I'm not sure that defining hostname as a fixed number of DOMAIN components, nor defining a limited set of EXT suffixes is the right way to go. Hostnames can be arbitrarily long, at least in terms of subdomains, and the list of top-level domains is growing by the day.
I'm probably going to settle just capturing NAME and laying off the semantics of IPv4, (later) IPv6, and neither of those to a custom action. Given the complexity of the problem (esp. IPv6), that is likely the best way forward.