# Cloudflare’s 1.1.1.1 starts validating post-quantum DNSSEC signatures Cloudflare has enabled ML-DSA-44 validation on 1.1.1.1, putting standardized post-quantum DNSSEC signatures into large-scale resolver traffic and exposing the packet-size and downgrade problems the wider DNS ecosystem must solve before a full migration. The change is separate from post-quantum TLS. DNSSEC signatures authenticate DNS records, and ML-DSA-44 makes them dramatically larger — 2,420 bytes per signature — while dual-signing with older algorithms creates a downgrade path unless resolvers enforce the post-quantum chain deliberately. - Status: Active - Published: 2026-09-11T22:02:35+12:00 - Updated: 2026-09-11T22:02:35+12:00 - Categories: Cloud & Infrastructure, Edge & CDN - Tags: Cloudflare, DNSSEC, post-quantum cryptography - Canonical HTML: https://beyondthe.news/dossiers/cloudflare-1111-post-quantum-dnssec-ml-dsa-44 ## What changed Cloudflare's 1.1.1.1 resolver now validates DNSSEC signatures using ML-DSA-44, the NIST-standardized post-quantum signature algorithm assigned DNSSEC algorithm number 18. ML-DSA-44 signatures are 2,420 bytes and public keys are 1,312 bytes, so signed DNS responses can exceed normal UDP budgets and trigger TCP or other transport fallback. During the transition, zones may publish both conventional and post-quantum signatures. Cloudflare applies a stricter local validation policy when an authenticated parent DS record indicates ML-DSA-44 support, requiring a valid post-quantum path instead of accepting a forgeable conventional path as a downgrade. This is resolver-side support, not a complete post-quantum DNSSEC chain; authoritative servers, registrars, registries and eventually the root still need compatible deployment. ## Why it matters TLS is not the only public-key system that quantum migration will touch. DNSSEC underpins authenticity for signed DNS records, and its migration has harder operational constraints because much larger signatures must pass through old network assumptions and because compatibility with older resolvers can undermine post-quantum security. Turning validation on in a resolver as large as 1.1.1.1 creates real-world evidence about bandwidth, TCP fallback, verification cost and broken middleboxes years before a quantum-safe chain is required everywhere. ## ML-DSA-44 is much larger than current DNSSEC signatures Cloudflare compares the 2,420-byte ML-DSA-44 signature with 64-byte ECDSA P-256 signatures. The post-quantum signature alone exceeds common DNS-over-UDP payload budgets, so resolvers and authoritative servers must handle truncation and retries without assuming DNS fits into a small datagram. ## Dual-signing creates a downgrade problem A transition cannot immediately remove conventional algorithms because older resolvers need them. But once a conventional signature algorithm becomes breakable, a resolver that accepts any valid path could be tricked into accepting a forged old-algorithm answer even though a post-quantum signature also exists. ## 1.1.1.1 enforces a stronger local rule when PQ support is authenticated Cloudflare uses DS records in the parent zone as the authenticated signal. When that chain says ML-DSA-44 should be present, 1.1.1.1 requires at least one valid post-quantum validation path rather than allowing a conventional path to satisfy validation by itself. ## Resolver support is only the first deployment layer A fully post-quantum DNSSEC chain also needs authoritative DNS software to sign with ML-DSA-44, registrars to submit the corresponding DS records, registries to publish them and eventually the DNS root to carry a post-quantum trust anchor. ## Large-scale testing now can expose operational failures early Cloudflare plans to measure verification cost, bandwidth and additional TCP use and to run background probes against post-quantum-signed test domains. The practical value today is discovering network and software assumptions before a future cryptographic emergency forces a rushed migration. ## Key details - 1.1.1.1 now validates ML-DSA-44 DNSSEC signatures. - ML-DSA-44 is standardized by NIST and has DNSSEC algorithm number 18. - An ML-DSA-44 signature is 2,420 bytes; its public key is 1,312 bytes. - Large responses can exceed common UDP payload limits and require retry over another transport such as TCP. - Cloudflare applies downgrade protection when an authenticated DS record indicates a supported post-quantum algorithm. - Existing DNSSEC zones continue to validate normally; 1.1.1.1 users do not need to change configuration. - Cloudflare says authoritative signing and Registrar DS support are next steps and plans to make them available free to customers. - A complete post-quantum DNSSEC chain ultimately requires deployment through registries and the root. ## Builder takeaways - DNS operators testing post-quantum signing should include TCP fallback, fragmented-network paths and middlebox behavior in their test plan; cryptographic correctness is not enough. - Do not describe dual-signing alone as post-quantum secure. Validators need a trustworthy rule that prevents fallback to a compromised legacy algorithm. - If you operate resolver or authoritative DNS software, start tracking ML-DSA-44 library and protocol support before root-zone migration becomes urgent. - Measure DNS response size and transport behavior in observability tooling so a future signature-algorithm change does not look like unexplained latency or resolution failure. - Treat DNSSEC post-quantum migration separately from TLS migration; the trust chain, compatibility problem and packet economics are different. ## What to watch - Cloudflare Authoritative DNS and Registrar support for ML-DSA-44. - Adoption by other public resolvers and major authoritative DNS implementations. - Registrar/registry support for ML-DSA-44 DS records and eventual root-zone plans. - Measured increases in TCP fallback, bandwidth, latency and verification CPU at scale. - Standards work around authenticated downgrade protection during multi-algorithm DNSSEC transitions. ## Uncertainties - Quantum computers capable of breaking deployed DNSSEC keys do not currently exist, so this is migration preparation rather than response to an active cryptographic break. - ML-DSA-44 may coexist with future standardized post-quantum signature algorithms; the eventual long-term DNSSEC choice is not guaranteed to be singular. - Cloudflare's stricter validation rule is a local policy and broader ecosystem convergence on downgrade behavior is still evolving. ## Sources - [1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it](https://blog.cloudflare.com/post-quantum-dnssec-1111/) — Cloudflare · primary engineering announcement · 2026-09-10T00:00:00+12:00. Primary source for ML-DSA-44 validation, signature/key sizes, transport impact, downgrade handling and migration roadmap.