I've spent a bit of time researching this topic and can't seem to find an exact answer, so I'm fairly confident it's not a duplicate, and while my question is based on a security need, I think it's still safe to ask here but let me know if I need to move it the security community.
Essentially, do DNS queries ever use TCP (if so, what scenario could this occur)? Again, I'm only talking about queries. Is it possible for them to travel over TCP? If domains can only be a max of 253 bytes in length, and UDP packets can be as large as 512 bytes, won't queries always go out as UDP? I didn't think a resolvable query could be large enough to require the use of TCP. If a DNS server ever got a request for a domain larger than 253 bytes, would the server drop it/not try and resolve it? I'm certain I've made some false assumptions here.
For some context, I'm working with the security group to onboard DNS queries into their security monitoring tool, and for various reasons we've decided we will capture this traffic via standard packet capture on DNS servers and domain controllers. The core requirement is to capture all DNS queries so they can identify what client attempted to resolve any given domain. Based on this requirement, we aren't concerned with capturing DNS responses or other traffic like zone transfers, which is also driven by the fact that we need to limit log volume as much as possible. As such, we are planning to capture only DNS queries destined for the DNS server and sent over UDP. For more context (kind of question scope creeping here), it's now been brought up that we might need to expand security's visibility so they can monitor for activity like covert channels running over DNS (which would present the need to capture DNS responses as well, and subsequently TCP traffic). But even in that sort of scenario, I thought any outbound DNS traffic would be in the form of lookups/queries, and that these would always be over UDP, even if from a malicious source (because of my reasoning in the first paragraph). So this brings up some additional questions:
Wouldn we at minimum be capturing half of the conversation with the approach I outlined? Or would a client ever send out DNS traffic that isn't in the form of a query? (maybe like some kind of reply to a DNS server's response, and maybe ends up going out over TCP)
Can DNS queries be modified to use TCP? Would a DNS server accept and respond to a DNS query coming over TCP?
Not sure if it's relevant, but we do limit DNS requests to authorized DNS servers and block all other traffic outbound over port 53. I'm definitely a rookie, so I'm sorry if my question isn't compliant, and let me know how I should modify.