DNS, as far as I know, will only go over TCP for two reasons:
1) Zone Transfer
2) Large DNS response will not fit into 1 65K UDP packet

This signature is looking at UDP but is looking for content 00 00 FC, 14 bytes into the packet, which if I had to make a wild guess without looking, would be what a zone transfer request would look like initially if requested over UDP.