Cloudflare has enabled its 1.1.1.1 public resolver to validate DNSSEC signatures made with ML-DSA-44, the NIST-standardised post-quantum signature algorithm, the company said on 10 September 2026.
Cloudflare called it a first step toward preparing DNSSEC for a time when today’s signature algorithms are no longer secure. It plans to reach full post-quantum security by 2029.
The difficulty is size. Each ML-DSA-44 signature is 2,420 bytes and each public key 1,312 bytes, which exceeds common DNS-over-UDP limits and pushes resolvers to retry over TCP. Zones will also need to publish conventional signatures for older resolvers for years, which creates a possible downgrade path. Cloudflare said around 85% of queries to 1.1.1.1 arrive over UDP.
Validation happens automatically when a zone publishes the necessary records; existing DNSSEC zones validate as before. Cloudflare said its next step is ML-DSA-44 signing in Cloudflare Authoritative DNS and DS record support in Cloudflare Registrar, free for all customers.