Block all dns record and allow only A record irule

when DNS_REQUEST {
    switch [string toupper [DNS::question type]] {    
        "A" {
                return
        }
        default {
            reject
        }
    }
}

Not much different from yours, but I'd use "switch" to make it easier for future modification, and "reject" to stop the client from resending packets.

And does your DNS server actually support multiple queries in one packet?

[Edit] Added missing closing brace.