Both UDP and TCP can be used for DDOS and there is nothing in these protocols which can protect against is. But what you probably mean is not a general DDOS attack but an amplification attack together with source spoofing.
Source spoofing means that the claimed source IP address of the client is different from the real source IP and thus the response will be sent not to the real client (the attacker) but to the claimed source (the target of the DDOS attack). Source spoofing is not possible with TCP since the initial handshake makes sure that the claimed client is actually the real client.
An amplification attack means that the response is considerable larger then the request, i.e. typically a DNS query is small but the DNS response can be really large if it contains lots of DNS records which is common for hosts with multiple IP addresses. Combined with source spoofing this means that an attacker with low bandwidth can cause an attack with high bandwidth against the target.
To protect against source spoofing use a protocol which is not affected like TCP or identify the client some other way, like through a shared secret. To protect against combining source spoofing with amplification make sure that your response is small at least as long as the client is not identified correctly to protect against source spoofing. Thus for a new client you could send a small response back containing a secret (nonce) and only for requests from clients containing this secret you will do a larger response.
Another protection against these kinds of attack is not at the protocol level but at the application level, in that you restrict the amount of data sent to a specific IP address, at least as long the client requesting these data was not properly identified.