Link: Direct link to Zoom Docs from non-Zoom sender

type.inbound
// contains a link to zoom docs
and any(body.links, .href_url.domain.domain == "docs.zoom.us")
// is the only link to zoom
and length(filter(body.links, .href_url.domain.root_domain == "zoom.us")) == 1
// not from zoom.us
and not (
  sender.email.domain.root_domain == "zoom.us"
  and headers.auth_summary.dmarc.pass
)