dnsmasq breaks Steam downloads on Comcast

TL;DR: With dnsmasq configured, "nslookup cdn.cs.comcast.steampowered.com" (rather, the query, not nslookup itself) hangs. As a result of the DNS query hanging, Steam is unable to download any game content.

Longer explanation, which I posted on the Steam forum at http://steamcommunity.com/discussions/forum/1/412446292762583371/ to help other users:

I had a persistent problem with Steam not downloading games on Ubuntu, even on the same machine and same network where it worked fine under Windows (both 7 and 10). Here's an explanation of why and how to fix it, since most people will not be able to diagnose it.

Background:

Like most big data providers, Steam has a lot of servers hosted at various ISPs. When you download a game, you're directed to servers that are topologically closer to you--usually ones hosted by the ISP you use. In my case, this is Comcast, and Steam uses the host name cdn.comcast.cs.steampowered.com.

Ubuntu Desktop uses a caching DNS server called dnsmasq. Besides providing caching services, it captures advertised hostnames on the network, allowing you to refer to other machines by name without having to set up DNS.

Symptom:

You'll get dialog windows and messages in the Steam log file saying that connections timed out. No downloads will actually work.

Interestingly, nowhere does it explicitly tell you that it's actually the DNS query that's timing out, as opposed to the connection to the actual content server. This confused me quite a bit.

The problem:

Steam's DNS and dnsmasq don't get along. The list of DNS records for cdn.comcast.cs.steampowered.com is long enough that the response doesn't fit in a UDP packet. Normally this is retried transparently over TCP and works fine. However, dnsmasq stalls and times out on this request. (Don't ask me why. I haven't debugged it--yet.) As a result, all attempts to connect to the Steam content servers fail, and no downloads occur.

Note: I've only run the Steam client on Ubuntu 14.10 and 15.04. I do not know whether this problem affects other versions.

Workaround:

The obvious workaround is to stop using dnsmasq. However, it's somewhat hardwired into Ubuntu. Here's what I did:

# apt-get install unbound # do this first or you'll be sad
# cd /etc/NetworkManager
# service NetworkManager stop
# vi NetworkManager.conf # or whatever editor you want; I don't care
[change "dns=dnsmasq" to "dns=unbound"]
# rm /etc/resolv.conf # don't forget this
# service NetworkManager start

Now all your DNS queries should go through your local unbound server (at 127.0.0.1 a.k.a. localhost), retries over TCP should work as expected, and Steam should be able to download just fine. You can test it with:

# nslookup cdn.comcast.cs.steampowered.com

If that hangs or returns SERVFAIL or REFUSED, you still have a problem.