JA EN
shiichan

1.1.1.1 Just Validated a 2,420-Byte Signature! Post-Quantum DNSSEC Has Arrived

Cloudflare Blog ★★★ View Markdown
#cloudflare#security

Hi everyone, it's me, Shiichan! Today's a quiet but important step toward a post-quantum internet.

Cloudflare Blog blog.cloudflare.com

What was announced?

The Cloudflare Blog announced that 1.1.1.1, its public DNS resolver, now validates DNSSEC signatures using NIST's post-quantum algorithm, ML-DSA-44. This is part of Cloudflare's broader plan to reach full post-quantum security by 2029.

Why it matters

Once quantum computers become practical, many of today's cryptographic algorithms could be broken — so the signature algorithms underpinning DNSSEC, which is what makes DNS trustworthy, need to go post-quantum too. But DNSSEC has an awkward structural problem here: signature size collides directly with constraints baked into DNS itself, one of the internet's most fundamental protocols.

What changes

An ML-DSA-44 signature is 2,420 bytes — about 38 times larger than a traditional ECDSA P-256 signature. DNS responses over UDP are conventionally limited to 1,232 bytes, so simply attaching a signature this large causes UDP response fragmentation, hurting reliability. Once you add the actual DNS record and other data on top, it doesn't come close to fitting in typical UDP response sizes.

Dive Deep

The other challenge is designing the transition period itself. To maintain backward compatibility, both the old signature algorithm and ML-DSA-44 need to be published side by side during the migration. That dual-publishing window creates a downgrade-attack risk: while the old algorithm is still considered safe, an attacker could forge just the old signature and get away with it.

By running this on 1.1.1.1 first, Cloudflare gets real internet-scale experience with reliably handling oversized DNS responses and validating downgrade paths — insight that's essential for phasing the entire DNSSEC ecosystem toward post-quantum safely.

Wrap-up

  • Cloudflare's 1.1.1.1 now validates DNSSEC signatures using NIST's post-quantum ML-DSA-44 algorithm.
  • ML-DSA-44 signatures are 2,420 bytes, about 38x larger than ECDSA P-256, which exceeds the standard 1,232-byte UDP limit.
  • The transition period requires publishing both old and new signatures, creating a downgrade-attack risk that needs careful management.
  • Running this at internet scale on 1.1.1.1 is how Cloudflare is gathering real-world implementation experience.
  • Worth knowing about if you work on DNS or internet-infrastructure security and are thinking ahead about post-quantum migration.

Related posts