Cloudflare’s 1.1.1.1 resolver began validating DNSSEC signatures made with ML-DSA-44 on September 10, 2026 Cloudflare Blog, marking the first large-scale deployment of a post-quantum signature algorithm in DNSSEC.
ML-DSA-44 is a post-quantum signature algorithm standardized by the National Institute of Standards and Technology (NIST) in 2024 NIST. Each signature is 2,420 bytes — almost 38 times larger than the 64-byte ECDSA P-256 signatures commonly used today. That size difference creates two linked problems: carrying the larger responses reliably, and preventing older resolvers from weakening protection for newer ones.
Image credit: Cloudflare Blog
The size challenge is immediate. DNS originally restricted messages sent over UDP to 512 bytes. EDNS(0) later allowed resolvers to advertise larger UDP payloads, and many implementations use a conservative limit of 1,232 bytes to fit within IPv6’s minimum MTU of 1,280 bytes. RFC 9715 recommended a maximum of 1,400 bytes for DNS over UDP. An ML-DSA-44 signature exceeds that budget on its own.
DNSKEY responses illustrate the problem most clearly. They must carry the public keys a resolver needs to validate a zone. An ML-DSA-44 public key alone is 1,312 bytes, and the DNSKEY record set also includes a 2,420-byte signature. Key rollovers can add still more keys, pushing these responses even larger.
Cloudflare’s telemetry indicates that roughly 85% of queries reaching 1.1.1.1 come in over UDP. The platform behind 1.1.1.1 — internally called Big Pineapple — also powers other DNS services including Gateway DNS. Across all services handled by that platform, about 60% of queries arrive over UDP, with the remaining 40% using transports such as TCP, DNS over TLS, and DNS over HTTPS.
The downgrade risk is more subtle. Replacing an existing DNSSEC algorithm cannot happen all at once. The practical approach is to publish both conventional and post-quantum keys and signatures together. RFC 6840 specifies that validators should accept any single valid path. After a conventional algorithm such as ECDSA becomes insecure, however, that same rule opens a downgrade path. An attacker could forge an ECDSA-only answer that a resolver accepts despite supporting ML-DSA-44.
To stop this downgrade, the resolver needs an authenticated signal that a zone should be validated with ML-DSA-44. 1.1.1.1 looks for that signal in DS records published by the parent zone. When the authenticated DS RRset includes a record for a supported post-quantum algorithm, the signal is present. The resolver then enforces a stricter local policy: it demands at least one valid post-quantum validation path; a conventional path alone no longer suffices. If no ML-DSA-44 path validates, the check fails. RFC 4035 permits local resolver policy to decide whether additional signatures must be verified.
This downgrade protection only works if ML-DSA-44 deployment and the stricter policy extend from the trust anchor through every delegation. Rotating the zone key more often does not fix the issue: an attacker can target a vulnerable key anywhere higher in the chain and forge every delegation below it — a “break once, forge everywhere” scenario.
Quantum computers able to carry out these attacks do not exist today. DNSSEC provides authenticity rather than confidentiality, so it avoids “harvest now, decrypt later” threats. The reason to start now is that changing DNSSEC demands coordination across authoritative servers, registries, registrars, and validating resolvers. The migration must eventually reach the DNS root, where a single compromised key could undermine the entire hierarchy. Cloudflare is preparing for the possibility that in 2030 a sufficiently powerful quantum computer could be built that breaks these keys Cloudflare Blog.
The 1.1.1.1 deployment lets Cloudflare, and the DNS ecosystem at large, gain operational experience with post-quantum DNSSEC at Internet scale. That experience matters: widespread client adoption of post-quantum TLS took years, partly because larger messages exposed assumptions and bugs in existing network software. Early large-scale testing showed why waiting until quantum computers become an immediate threat is not an option.
For context on why DNSSEC migration timelines matter, see our earlier coverage of Cloudflare’s AI vulnerability discovery using Daybreak.
