Cloudflare's 1.1.1.1 Now Validates Post-Quantum DNSSEC With ML-DSA-44
Cloudflare Blog · rss · 2026-09-10
Cloudflare's 1.1.1.1 resolver now validates DNSSEC signatures made with ML-DSA-44, the NIST-standardized post-quantum signature algorithm — a first step toward full post-quantum security by 2029.
Why now
- Today's RSA/ECDSA-based DNSSEC would fall to a future quantum computer; a broken root zone key would let attackers forge validation paths for any zone — "break once, forge everywhere."
- DNSSEC offers authenticity (not confidentiality), so no harvest-now-decrypt-later risk, but migration requires coordinating registries, registrars, and resolvers — hence starting early.
Engineering challenges
- Signature size: an ML-DSA-44 signature is 2,420 bytes, 38x larger than ECDSA P-256's 64 bytes, exceeding common DNS-over-UDP budgets (1,232–1,400 bytes) on its own; responses must be truncated with TCP fallback. 85% of queries to 1.1.1.1 arrive over UDP.
- Downgrade risk: zones must publish both conventional and post-quantum keys during migration, but RFC 6840 lets validators accept any single valid path, letting attackers forge ECDSA-only answers. 1.1.1.1 uses parent-zone DS records to detect the post-quantum signal and applies stricter local policy: at least one valid ML-DSA-44 path is required; conventional paths alone no longer suffice.
More from Infra
- DeepSpeed shows AutoEP/AutoTP/AutoSP parallelism gains, hosts office hours — PyTorch · 2026-10-27
- Running a local 9B as a coding agent: brief the big model to plan, let the small model execute — Electrical_Ninja3805 · 2026-10-27
- Cloudflare Durable Objects validated as top architecture for AI agent WebSocket servers — tristanbob · 2026-10-27
- Gary Marcus: With Q3 data added, Anthropic's compute-efficiency growth shows deceleration — GaryMarcus · 2026-10-27
- SpaceX locks in $40B GPU financing deal with Apollo, the largest ever committed — TechCrunch AI · 2026-10-27
- Inference is just Kubernetes with a multi-trillion-dollar market, and the communities overlap — matt_slotnick · 2026-10-27