Cloudflare has started validating post-quantum DNS signatures

Cloudflare's public DNS resolver 1.1.1.1 has begun validating DNS signatures produced with a post-quantum signature algorithm. The algorithm is ML-DSA-44, standardised by the American standards body NIST.

DNS is the system that turns the name you type into an address. DNSSEC is the layer that proves, with a signature, that the answer was not altered on the way. The signatures in use today are considered breakable once a sufficiently powerful quantum computer exists. This step is an attempt to prepare the infrastructure before that day arrives.

The problem is the size of the signature

An ML-DSA-44 signature is 2,420 bytes and its public key is 1,312 bytes. The ECDSA P-256 signature in use today is 64 bytes. The new signature is roughly 38 times larger.

For DNS that is a serious difficulty. DNS traditionally worked with 512-byte packets; the common limit today is 1,232 bytes, because IPv6's minimum packet size is 1,280 bytes. A single signature exceeds that budget on its own.

Once the budget is exceeded, the answer falls back from UDP to TCP. TCP is slower, needs more round trips, and makes every lookup a little more expensive.

The transition years are the risky part

Cloudflare is aiming for full post-quantum security by 2029. During the transition, resolvers have to support both the old and the new signatures.

That is where the real fragility sits. As long as both methods stand side by side, an attacker can try forging a signature with the older one. If a validator does not know to reject the old signatures once the quantum threat is real, the new algorithm buys nothing.

Cloudflare began experimenting with post-quantum key agreement in TLS in 2019 and opened it to customers in 2022. DNS is one of the last links in that chain.

Source: Cloudflare blog.