Cloudflare Tests Post Quantum DNSSEC with Oversized Signatures

Cloudflare’s 1.1.1[.]1 now validates DNSSEC signatures created with ML-DSA-44, a post-quantum signature algorithm standardised by NIST. This marks a first experimental step toward preparing DNSSEC for a future in which current signing schemes may no longer be secure. Cloudflare aims for full post-quantum security by 2029, expanding post-quantum work beyond TLS into DNSSEC, which also relies on public-key cryptography.

The post-quantum signature, ML-DSA-44, is substantially larger than today’s signatures: a single ML-DSA-44 signature is 2,420 bytes, and the corresponding public key in DNSKEY records is 1,312 bytes. That size challenges existing DNS transport budgets: common UDP DNS payload limits (and typical resolver budgets) can be exceeded, forcing the server to return truncated responses and rely on TCP or other transports.

To avoid compatibility gaps, zones will need to publish both conventional and post-quantum signatures and keys, risking larger responses and potential downgrade paths if validators accept older algorithms. The article explains that RFC 6840 allows validators to accept any valid published path, but once a conventional algorithm becomes insecure, a downgrade path could be exploited unless migration is carefully coordinated across roots, registries, registrars, and resolvers.

Cloudflare’s testing at Internet scale aims to understand and mitigate these challenges, including the behavior of DNSKEY responses and the need for dual signing during the transition.