How does a AsTMa? query look like then?

firewall
bn: firewall.example.org

forall [ (is-A-record-for)
         fqdn     : firewall
         A-record : $ip ] in tm:/internet/dns/
return
     ($ip)

or

forall [ (is-A-record-for)
         A-record : $ip
         fqdn     : $fqdn ]
       and
       [ $fqdn is-a fqdn
         bn: qr/\.example\.org$/ ]
return
     ($ip)