You don't need to rigidly and purely enforce rules only from test results but rather also embedded wisdom, defaults and recommendations.

ICMP is a well known gotcha and the only such protocol in its class.

I've personally never seen a fallback to TCP requirement in the wild but you could easily say "if DNS then enable both protocols" as a general rule, and add <received wisdom>.

These are easy to add as policies and will result in better rules than manually configured systems in many cases, if documented. Everyone's happy.