Cloudflare’s 1.1.1.1 begins validating post-quantum DNSSEC signatures

Cloudflare said on 10 September that its 1.1.1.1 resolver could validate DNSSEC signatures using ML-DSA-44. DNSSEC authenticates records; it does not encrypt their contents. Supporting a post-quantum signature algorithm is one step toward testing how DNS authentication can change before sufficiently capable quantum computers exist.

An ML-DSA-44 signature is 2,420 bytes, larger than common DNS-over-UDP limits before the rest of a response is counted. Cloudflare wants operational experience with larger responses and with preventing unsafe fallback when zones also publish conventional signatures for older resolvers. Resolver support does not migrate the entire DNS hierarchy. Authoritative servers, registries, registrars and other validating resolvers must also coordinate changes for a broader transition.