If the name server receives a question via UDP, that's how it will answer,
necessarily. The client could have asked via TCP, but it doesn't know how
large the response will be when it sends the question.

The general intention here is that the client will receive either an ICMP
message or a reply, if no reply arrives (some people firewall away ICMP in
the name of safety), the client is supposed to time out and retry via TCP,
but that timeout can be too slow. Last time I ran into that the upper-level
protocol timed out the DNS query before the DNS library switched to TCP.

Arnt