Cloudflare 1.1.1.1 Validates ML-DSA-44 Post-Quantum DNSSEC
Emerging Technology Risk · 3 sources · Updated 2mo ago · First seen Sep 10, 2026
Cloudflare has enabled validation of NIST-standardized ML-DSA-44 post-quantum DNSSEC signatures on its 1.1.1.1 public resolver. Where an authenticated parent DS record advertises the algorithm, the resolver requires a valid ML-DSA-44 chain of trust rather than falling back to conventional signatures, protecting dual-signed migrations against downgrade attacks.
The rollout provides Internet-scale testing of major operational constraints: ML-DSA-44 signatures are about 2,420 bytes, often exceeding standard DNS-over-UDP payload limits and triggering truncated responses and TCP fallback. End-to-end post-quantum DNSSEC remains dependent on adoption across authoritative DNS operators, registrars, registries, TLDs, the DNS root, and other validating resolvers; Cloudflare has stated a goal of full post-quantum security by 2029.
