I found the answer myself.
TCP connection handling is required too. Some software rely on TCP DNS queries, and they are properly passed to the NEDNSProxyProvider as NEAppProxyTCPFlow.
To simply test that case, it is possible to use dig +tcp www.example.com in the terminal.