DNS servers answer queries on port 53. UDP is the default; TCP is mandatory (RFC 7766) for large responses, e.g. with DNSSEC, and for zone transfers (AXFR/IXFR). Allowing only UDP causes intermittent resolution failures.
Public only for authoritative nameservers of your zones. Never open a recursive resolver to everyone: open resolvers are abused for DNS amplification. Restrict recursion to your own networks with access-control in Unbound or allow-recursion in BIND.
Typical issues: SERVFAIL from broken DNSSEC signatures or expired RRSIGs, and zone transfers failing because TCP is blocked between primary and secondary.
Check
dig @ns1.example.com example.com SOA +tcp