1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it
What Happened
Cloudflareâs 1.1.1.1 DNS resolver now validates DNSSEC signatures made with the postâquantum algorithm MLâDSAâ44, which produces 2,420âbyte signatures. This is the first largeâscale deployment of a postâquantum signature in DNSSEC, allowing Cloudflare to test handling of large DNS responses and preventing fallback to legacy signatures. Cloudflare plans to achieve full postâquantum security by 2029 and has already enabled postâquantum key agreement in TLS since 2019.
Why It Matters
Enterprise architects should note that DNSSEC will soon require larger packet sizes and more robust resolver infrastructure to support postâquantum signatures, impacting network design and performance budgets. The move signals a shift toward quantumâresistant cryptography across core internet protocols, necessitating updates to security governance and compliance frameworks. Failure to adopt compatible resolvers could expose organizations to future quantumâbased DNS spoofing attacks.
The Limitation
The current deployment is limited to Cloudflareâs public resolver; widespread adoption depends on resolver vendors and DNS infrastructure upgrades, which may take several years to mature.
What You Can Do
Update your DNS resolver stack to support MLâDSAâ44 or equivalent postâquantum signatures and validate that your network can handle 2,420âbyte DNS responses without fragmentation.