[dnsdist] dnstap shows UDP for a DoH-query

[Tom]

Hi

I'm logging dnsdist queries/responses with newFrameStreamUnixLogger to a 
unix socket, where fstrm_capture takes the data and write it to a 
fstrm-file.

When querying dnsdist with DoH (TCP), then my fstrm-log shows UDP (see 
below).

$ dnstap-read -p 2021-06-13-dnstap.fstrm
...
...
14-Jun-2021 14:19:30.058 CQ x.x.x.x:44749 -> y.y.y.y:443 UDP 51b 
google.com/IN/A
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:   1015
;; flags: rd ad; QUESTION: 1, ANSWER: 0, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 1f5e39ad95e85cd8
;; QUESTION SECTION:
;google.com.			IN	A

14-Jun-2021 14:19:30.059 CR x.x.x.x:44749 <- y.y.y.y:443 UDP 83b 
google.com/IN/A
;; ->>HEADER<<- opcode: QUERY, status: NOERROR, id:   1015
;; flags: qr rd ra; QUESTION: 1, ANSWER: 1, AUTHORITY: 0, ADDITIONAL: 1
;; OPT PSEUDOSECTION:
; EDNS: version: 0, flags:; udp: 1232
; COOKIE: 1f5e39ad95e85cd80100000060c74952f681b113fec0d503
;; QUESTION SECTION:
;google.com.			IN	A

;; ANSWER SECTION:
google.com.		266	IN	A	216.58.215.238
...
...


My question is:
Why do I see the protocol "UDP" in the fstrm-log for a DoH request, 
although I am sure (tcpdump) that this request was made with tcp? Maybe 
because dnsdist queries the backend server with UDP for the DoH request?

Many thanks for any explanations.

Kind regards,
Tom