Suricata

Or maybe better to enable the user to do something like:

content:"example.com"; tls_sni;

I don't really like how the TLS keywords deviates from the other rule keywords.

For newly developed keyword we generally follow the 'file_data' approach:

file_data; content:"pattern";

So here it would be:

tls_sni; content:"example.com";

Is that the reason why the "dns_query" keyword is placed before the "content" instead of after like so many other keywords? I have been wondering why it's like that.

Yes. The scheme is much simpler that way. All payload inspecting keywords that follow "file_data" or "dns_query" automatically apply to the correct buffer. E.g.

file_data; content:"blah"; pcre:/blabblah/;

content:"blah"; http_uri; pcre:/blabblah/U;

Then I'll implement it like that :)