> ## Content Index
> Fetch the complete content index at: https://www.ai-360.online/llms.txt
> Use this file to discover other available public pages before exploring further.

# Cloudflare’s 1.1.1.1 resolver now validates post-quantum DNSSEC signatures
- URL: https://www.ai-360.online/cloudflare-adds-post-quantum-dnssec-validation-to-production-1-1-1-1-infrastructure/
- Published: 2026-09-16T09:19:00.000Z
- Updated: 2026-10-31T22:04:45.000Z
- Description: Cloudflare's 1.1.1.1 resolver now validates ML-DSA-44 post-quantum DNSSEC signatures, a first test of carrying much larger DNS responses at internet scale.
- Author: AI-360
- Tags: 2. Security, News, PQC, Enterprise AI

[Cloudflare](https://www.cloudflare.com/?ref=ai-360.online) has enabled its 1.1.1.1 public resolver to validate DNSSEC signatures made with ML-DSA-44, the NIST-standardised post-quantum signature algorithm, [the company said on 10 September 2026](https://blog.cloudflare.com/post-quantum-dnssec-1111/?ref=ai-360.online).

Cloudflare called it a first step toward preparing DNSSEC for a time when today’s signature algorithms are no longer secure. It plans to reach full post-quantum security by 2029.

The difficulty is size. Each ML-DSA-44 signature is 2,420 bytes and each public key 1,312 bytes, which exceeds common DNS-over-UDP limits and pushes resolvers to retry over TCP. Zones will also need to publish conventional signatures for older resolvers for years, which creates a possible downgrade path. Cloudflare said around 85% of queries to 1.1.1.1 arrive over UDP.

Validation happens automatically when a zone publishes the necessary records; existing DNSSEC zones validate as before. Cloudflare said its next step is ML-DSA-44 signing in Cloudflare Authoritative DNS and DS record support in Cloudflare Registrar, free for all customers.

---