What could stop bitcoin-seeder from "hearing" DNS queries?
The problem stems from the way Ubuntu 18 handles DNS resolution.

My clue was comparing the output of netstat -an | grep "LISTEN " on a machine with a working dnsseed vs the Ubuntu 18 machine with a non-responding dnsseed

The Ubuntu 18 machine showed

 tcp        0      0 127.0.0.53:53           0.0.0.0:*               LISTEN  


(which the other did not). Finding this line rather odd, a search for "DNS 127.0.0.53:53" revealed that Ubuntu 18 is handling DNS resolution requests in a particular way (which I have not deciphered), but I found a work-around, which proves dnsseed is not at issue. 

dnsseed will answer on Ubuntu 18 on non-standard DNS ports (other than port 53), so the workaround is to use iptables' network address translation feature (NAT) to intercept incoming DNS queries on port 53 and translate them to some other port (using port 5353 in this example) where dnsseed will "see" them.

    dnsseed   -h shido.bitmark.one   -n 139.162.122.138   -p 5353       -m marker@bitmark.io
    srcPort=53
    dstPort=5353
    iptables -t nat -A PREROUTING -i eth0 -p tcp --dport $srcPort -j REDIRECT --to-port $dstPort
    iptables -t nat -A PREROUTING -i eth0 -p udp --dport $srcPort -j REDIRECT --to-port $dstPort