Cloudflare 1.1.1.1 Now Supports Post-Quantum DNSSEC

Cloudflare's public DNS resolver 1.1.1.1 now supports post-quantum DNSSEC using the ML-DSA-44 algorithm, handling validation responses of 2,420 bytes. The update was announced on September 10, 2026 by Cloudflare engineers Sebastiaan Neuteboom and Bas Westerbaan. DNSSEC is a security layer for the Domain Name System, the internet's address book, that digitally signs DNS answers so a user can be confident they are reaching the real website and not a fake one. Post-quantum cryptography refers to algorithms designed to resist attacks by future quantum computers, which could break many of today's widely used encryption and signature methods.

DNSSEC works by adding a digital signature, a cryptographic stamp, to each DNS record. When a resolver like 1.1.1.1 looks up a domain, it checks that signature against published cryptographic keys. If the signature matches, the answer is authentic; if not, the resolver discards it. Today's DNSSEC signatures largely rely on classical algorithms such as RSA and elliptic curve cryptography. Those algorithms are considered secure against current computers but would be vulnerable to a sufficiently powerful quantum computer, which could solve the underlying mathematical problems far faster. ML-DSA-44 is a post-quantum digital signature algorithm designed around a different mathematical problem, lattice-based cryptography, that is believed to remain hard even for quantum machines. By validating DNSSEC records signed with ML-DSA-44, 1.1.1.1 extends the same authentication protection into the era when large quantum computers might become practical.

The size in the announcement, 2,420 bytes, is significant because DNS traditionally works over small, lightweight messages. Legacy DNS responses often fit within 512 bytes, and even extended UDP responses can face fragmentation when they grow too large. Fragmented DNS packets can be dropped by middleboxes, cause timeouts, or in some older configurations be blocked outright. Supporting a full 2,420-byte post-quantum DNSSEC response therefore requires careful handling in the resolver and across networks that carry DNS traffic. The headline's phrase "all 2,420 bytes of it" calls attention to this size: it is not a typo or a measurement error, but the actual size of a response that carries the larger post-quantum signature along with its cryptographic proof.

Cloudflare's blog also tells readers they can test whether their current resolver is post-quantum ready using a tool titled "Is your DNS resolver post-quantum ready?" The announcement notes that the community is tracking ML-DSA-44 software support on GitHub, which means developers and operators can follow which DNS software, libraries, and tools have added the ability to sign or validate with this algorithm. That matters because resolver support alone is not enough: authoritative DNS servers, domain registrars, hosting providers, and client software all eventually need to support post-quantum DNSSEC for full end-to-end protection.

For organizations that run their own DNS resolvers or manage domain names, the update is a signal to begin planning for post-quantum DNSSEC. Authoritative DNS providers need to support signing with ML-DSA-44, and recursive resolvers need to validate it. Network administrators should check whether their DNS software, firewalls, and monitoring tools can handle the larger response sizes, because a 2,420-byte DNSSEC answer may require configuration changes for maximum UDP payload size or TCP fallback. The GitHub tracking effort mentioned by Cloudflare helps teams see which components are ready.

For everyday users and businesses, post-quantum DNSSEC is a quiet but important upgrade. Most people never see DNSSEC working; it runs in the background whenever a compatible resolver checks a signed domain. Without DNSSEC validation, an attacker who can intercept DNS traffic could send a forged answer and silently redirect a user to a malicious site. Post-quantum DNSSEC extends that protection so it remains trustworthy if quantum computers become able to break classical signatures. Choosing a resolver that keeps DNSSEC validation current, and that supports encrypted transport for DNS queries, reduces the risk of both spoofing and eavesdropping. For readers responsible for domains or office networks, a privacy-first encrypted DNS service such as AEU DNS offers encrypted DNS resolution and DNSSEC validation as part of a hardened online privacy and security setup, and selecting a resolver that stays aligned with post-quantum developments is a sensible defensive step.