Cloudflare adds post-quantum DNSSEC support to 1.1.1.1 resolver

Cloudflare has implemented support for validating post-quantum DNSSEC signatures on its 1.1.1.1 public DNS resolver. The service now validates signatures created with ML-DSA-44, a post-quantum algorithm recently standardized by the US National Institute of Standards and Technology (NIST).

This move is part of a broader strategy to achieve full post-quantum security by 2029. The goal is to protect the domain name system from future quantum-computing attacks that could potentially break current public-key cryptography, such as RSA and ECDSA, allowing attackers to forge DNS responses and redirect users to malicious sites.

A significant technical challenge in this transition is the increased size of cryptographic data. While the common ECDSA P-256 signature is only 64 bytes, the ML-DSA-44 signature is 2,420 bytes, with a public key of 1,312 bytes. Because these sizes exceed the typical limits for UDP-based DNS traffic, the system must handle larger packets by forcing resolvers to retry requests using the TCP protocol.