1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it

Summary

1.1.1.1 now validates DNSSEC signatures made with ML-DSA-44, a NIST-standardized post-quantum algorithm, as an initial step toward post-quantum DNSSEC. The operational problem is that each signature is 2,420 bytes—almost 38 times an ECDSA P-256 signature and larger than common DNS-over-UDP limits—while zones must continue publishing conventional signatures for older resolvers. Cloudflare’s resolver handles this by testing larger responses at Internet scale, relying on truncation and transport retries rather than fragmented UDP, and using authenticated DS records to require a valid post-quantum path when a zone advertises one, preventing downgrade to conventional validation. The change provides operational experience for an ecosystem migration that requires coordination across DNS participants; Cloudflare says it plans full post-quantum security by 2029.

Takeaways

1. 1

   An ML-DSA-44 public key is 1,312 bytes and its signature is 2,420 bytes, compared with 64-byte public keys and signatures for ECDSA P-256.

2. 2

   When a supported post-quantum algorithm appears in an authenticated DS RRset, 1.1.1.1 requires at least one valid ML-DSA-44 validation path; otherwise, validation fails.

3. 3

   DNSSEC protects authenticity rather than confidentiality, so it is not subject to “harvest now, decrypt later” attacks; the migration is motivated by the possibility of future quantum key recovery.