How to force wildcard DNS rewrite to only resolve for one subdomain level?

[Codebreaker101]

I have a private authoritative DNS server that handles *.vm.example.com ([/vm.example.com/]10.29.10.100:1053 in Upstream DNS servers)
I also have AdGuard Home setup for DNS rewrites *.example.com. to 10.27.30.103 where proxy server is located.

The problem is that requests, for example test.vm.example.com, gets rewritten to 10.27.30.103 instead of going out to 10.29.10.100:1053. Is there way to setup AdGuard Home so that only *.example.com gets rewritten and not *.vm.example.com?

One way that I know of is not to use DNS rewires feature and have another authoritative DNS server with Upstream DNS servers look like this:

[/vm.example.com/]10.29.10.100:1053
[/example.com/]10.29.10.101:1053
https://dns10.quad9.net/dns-query

But I do not wish to setup a whole instance of authoritative DNS for just one entry...

[ainar-g]

I'd suggest just using the $dnsrewrite rules, as they provide more power than the legacy DNS rewrite mechanism. That includes the ability to use regular expressions:

/^[^.]+\.example\.com$/$dnstype=A,dnsrewrite=NOERROR;A;10.27.30.103