Cloudflare 1.1.1.1 adds post-quantum DNSSEC validation

Cloudflare engineers Sebastiaan Neuteboom and Bas Westerbaan wrote in a 10 September 2026 company blog post that the 1.1.1.1 public resolver now validates DNSSEC signatures made with ML-DSA-44, a NIST-standardized post-quantum signature algorithm. The change is resolver-side validation, not a root-zone update.

Each ML-DSA-44 signature is 2,420 bytes, against 64 bytes for ECDSA P-256. That size can exceed common DNS-over-UDP limits before the rest of the answer is counted, so nameservers may return a truncated UDP reply and the resolver retries over TCP. Users of 1.1.1.1 need no configuration change. Validation is automatic when a zone publishes the needed records.

The downgrade rule is the part most one-line takes skip. When an authenticated parent DS RRset signals ML-DSA-44 support, Cloudflare's local policy requires a valid post-quantum validation path. A conventional path alone is no longer enough. RFC 4035 allows that local policy.

The work covers the resolver side only. Cloudflare's next step, not live for all customers yet, is ML-DSA-44 signing on Cloudflare Authoritative DNS and matching DS support via Cloudflare Registrar, offered free to customers. The company says it wants full post-quantum security by 2029. Broad deployment still needs the rest of the DNS hierarchy, including parent zones and eventually the root.

To see the oversized path, Cloudflare points operators at dig @1.1.1.1 valid.mldsa44.dnstest.dev +dnssec on the dnstest.dev test zone.

Some offers on this page may be paid placements or contain affiliate links.