You don't need to rigidly and purely enforce rules only from test results but rather also embedded wisdom, defaults and recommendations. ICMP is a well known g

You don't need to rigidly and purely enforce rules only from test results but rather also embedded wisdom, defaults and recommendations. ICMP is a well known gotcha and the only such protocol in its class. I've personally never seen a fallback to TCP requirement in the wild but you could easily say "if DNS then enable both protocols" as a general rule, and add <received wisdom>. These are easy to add as policies and will result in better rules than manually configured systems in many cases, if documented. Everyone's happy.