1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it
Blog post from Cloudflare
Cloudflare’s 1.1.1.1 resolver now validates DNSSEC signatures using ML-DSA-44, a NIST-standardized post-quantum algorithm, as an early step toward protecting DNS authentication from future quantum attacks and meeting Cloudflare’s stated goal of full post-quantum security by 2029. DNSSEC prevents forged DNS responses through a signed chain of trust from the root zone to individual domains, but current RSA and ECDSA signatures could be vulnerable to sufficiently capable quantum computers. ML-DSA-44 creates operational challenges because its 2,420-byte signatures and 1,312-byte public keys far exceed typical UDP DNS payload sizes, requiring reliable fallback to TCP or other transports and increasing bandwidth and processing demands. During the extended migration period, zones will need both conventional and post-quantum signatures for compatibility, creating a potential downgrade risk; 1.1.1.1 addresses this by requiring a valid ML-DSA-44 validation path when an authenticated parent DS record indicates post-quantum support. Complete protection will require adoption by authoritative DNS providers, registrars, registries, parent zones, and the DNS root, while Cloudflare plans further signing and DS-record support and will use large-scale measurements and test domains to assess deployment effects.
No tracked trend matches for this post yet.
Use this post, company, and trend context to find content marketing opportunities, perform competitive analysis, or address product feature gaps via the Plushcap MCP server or the Plushcap API.