It may sound like a highly technical update. But it points to something much bigger: the migration towards post-quantum security is moving from theory into infrastructure.
Why DNSSEC is important
Every time we visit a website, the Domain Name System (DNS) helps translate a human-readable domain name into the technical information computers need to find the right destination. DNSSEC adds an important layer of trust to that process. Through digital signatures, it allows systems to verify that DNS information is authentic and has not been manipulated along the way.
That security currently depends largely on cryptographic algorithms developed for the classical computing era. Powerful enough quantum computers could eventually undermine some of those algorithms.
What Cloudflare has changed
Cloudflare’s 1.1.1.1 resolver can now validate signatures created using ML-DSA-44, one of the post-quantum signature schemes standardised by NIST. For users of 1.1.1.1, there is nothing they need to change. Validation can happen automatically when a domain publishes the necessary post-quantum DNSSEC records.
But behind that seemingly simple change lies a considerable engineering challenge.
Post-quantum security comes with bigger signatures; one of the hurdles in post-quantum cryptography is size. An ECDSA P-256 signature commonly used in DNSSEC is only 64 bytes. An ML-DSA-44 signature is 2,420 bytes, almost 38 times larger. That is already bigger than common limits for DNS messages sent over UDP, even before other information is added to the response.
One step in a much larger migration
Cloudflare’s update does not suddenly make the entire DNS ecosystem quantum-safe.
For that to happen, post-quantum cryptography will eventually have to be supported across the full chain: from authoritative DNS servers and registrars to registries, resolvers and ultimately the DNS root itself. During the transition, classical and post-quantum cryptography will also need to coexist.
Developments like this one therefore create an opportunity to learn how post-quantum algorithms behave in real infrastructure: how much additional bandwidth they require, how networks handle larger messages and what changes will be necessary as adoption grows.
Quantum readiness starts before the threat arrives
Moving to quantum-safe infrastructure will be a gradual process involving technology providers, cybersecurity teams, researchers, policymakers and organisations across virtually every sector. Waiting until cryptographically relevant quantum computers arrive would leave very little room for that transition.
Testing standards, adapting infrastructure and building operational experience, is what will make tomorrow’s digital systems more resilient, and that is already happening today.
Want to dive deeper?
Cloudflare explains the technical implementation, the challenge of much larger ML-DSA-44 signatures and the road towards full post-quantum DNSSEC in more detail.
