You're right, it turns out dnsmasq was only installed because I had installed polipo, which depends on the dnsmasq package. Purging polipo removes dnsmasq.
I have been running polipo (with config files unmodified from default) for several years, including since fresh installing Ubuntu-Gnome 16.10. Only since the upgrade to 17.04 two weeks ago has this problem emerged. Presumably it will hit every user who installs polipo or dnsmasq in 17.04. $ cat /etc/hosts # Dynamic resolv.conf(5) file for glibc resolver(3) generated by resolvconf(8) # DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN # 127.0.0.53 is the systemd-resolved stub resolver. # run "systemd-resolve --status" to see details about the actual nameservers. nameserver 127.0.0.1 $ $ dpkg -l dnsmasq\* Desired=Unknown/Install/Remove/Purge/Hold | Status=Not/Inst/Conf-files/Unpacked/halF-conf/Half-inst/trig-aWait/Trig-pend |/ Err?=(none)/Reinst-required (Status,Err: uppercase=bad) ||/ Name Version Architecture Description +++-==============-============-============-================================= ii dnsmasq 2.76-5 all Small caching DNS proxy and DHCP/ ii dnsmasq-base 2.76-5 amd64 Small caching DNS proxy and DHCP/ $ $ cat /etc/NetworkManager/NetworkManager.conf [main] plugins=ifupdown,keyfile [ifupdown] managed=false -- You received this bug notification because you are a member of Ubuntu Bugs, which is subscribed to Ubuntu. https://bugs.launchpad.net/bugs/1672099 Title: DNS loop, >5,000 queries per second for minutes at a time To manage notifications about this bug go to: https://bugs.launchpad.net/ubuntu/+source/dnsmasq/+bug/1672099/+subscriptions -- ubuntu-bugs mailing list ubuntu-bugs@lists.ubuntu.com https://lists.ubuntu.com/mailman/listinfo/ubuntu-bugs