Cloudflare's 1.1.1.1 Now Validates Post-Quantum DNSSEC With ML-DSA-44
Cloudflare Blog · rss · 2026-09-10
Cloudflare's 1.1.1.1 resolver now validates DNSSEC signatures made with ML-DSA-44, the NIST-standardized post-quantum signature algorithm — a first step toward full post-quantum security by 2029.
Why now
- Today's RSA/ECDSA-based DNSSEC would fall to a future quantum computer; a broken root zone key would let attackers forge validation paths for any zone — "break once, forge everywhere."
- DNSSEC offers authenticity (not confidentiality), so no harvest-now-decrypt-later risk, but migration requires coordinating registries, registrars, and resolvers — hence starting early.
Engineering challenges
- Signature size: an ML-DSA-44 signature is 2,420 bytes, 38x larger than ECDSA P-256's 64 bytes, exceeding common DNS-over-UDP budgets (1,232–1,400 bytes) on its own; responses must be truncated with TCP fallback. 85% of queries to 1.1.1.1 arrive over UDP.
- Downgrade risk: zones must publish both conventional and post-quantum keys during migration, but RFC 6840 lets validators accept any single valid path, letting attackers forge ECDSA-only answers. 1.1.1.1 uses parent-zone DS records to detect the post-quantum signal and applies stricter local policy: at least one valid ML-DSA-44 path is required; conventional paths alone no longer suffice.
More from Infra
- M.2-Oculink eGPU Link Silently Downgrades to PCIe Gen1 — Here's How to Check — El_90 · 2026-09-11
- DeepSeek launches V4.1-Flash with 1M-token context and 4x smaller KV-cache — matlabulous · 2026-09-11
- What Can You Still Run on 8GB VRAM? User Asks for Small Models With Tool Use — riceinmybelly · 2026-09-11
- Spain's hourly 80% renewable matching rules clash as France fast-tracks 700MW sites, UK cuts grid queues — eherrerosj · 2026-09-11
- AI could add 0.3-0.4 points to Europe's productivity growth, but the EU holds under 5% of global compute — rohanpaul_ai · 2026-09-11
- Qualcomm's next-gen Hexagon NPU runs 30B MoE models with 32K context on-device — lee_stott · 2026-09-11