Cloudflare validates oversized quantum-safe DNS signatures

When your browser looks up a website address, a chain of queries translates it into a numeric address a computer can route to. Those answers can be signed, so your device knows nobody altered them in transit. On 10 September, Cloudflare enabled its public resolver, 1.1.1.1, to verify a new kind of signature designed to resist future quantum computers. A test domain already passes the check. Between that single validated lookup and a quantum-safe internet, though, lies a gap no single company can close.

The Wax Seal Gets Bigger

For a domain that uses DNSSEC, the relevant DNS records carry cryptographic signatures. A resolver can trace each signature back through a chain of trusted keys, confirming that the record came through the expected DNS authority and was not altered along the way. Think of it as a wax seal on a postcard: it authenticates the source, but anyone can still read the message. DNSSEC does not encrypt your query or protect your browsing session.

Today's seals use classical cryptography. A sufficiently powerful quantum computer could, in theory, forge them. ML-DSA-44, standardised by NIST in August 2024 as FIPS 204, is a signature scheme built on mathematical structures that quantum machines are not expected to crack. IANA has assigned it algorithm number 18 in the DNSSEC registry. What Cloudflare deployed is the ability to recognise and verify that algorithm when a domain publishes the right records (Cloudflare).

Users of 1.1.1.1 changed nothing. Domains using conventional algorithms continue to validate exactly as before. The resolver simply learned a new language.

Too Big for One Packet

The real engineering story is size. An ML-DSA-44 signature is 2,420 bytes, with a 1,312-byte public key on top (NIST FIPS 204, IETF draft). Classic DNS was built around small replies that fit in a single network packet. One quantum-resistant signature alone exceeds that comfortable size.

Oversized replies trigger a retry over TCP, the same protocol your browser uses for web pages, which handles large payloads reliably but adds a round trip. Cloudflare's published test, querying valid.mldsa44.dnstest.dev, shows this sequence completing in 20.7 milliseconds (Cloudflare). That proves the plumbing works. It is one example from one location, not a performance measurement across Cloudflare's global network. The company published no latency distributions, failure rates or bandwidth figures.

The Classical Chain Above

DNSSEC's trust chain starts at a root key and passes through top-level domains (.com, .de, .fr) before reaching any individual website. Today, the DNS root and the layers above individual domains still sign with classical algorithms. Cloudflare itself lists signing its own authoritative DNS zones and enabling its registrar to submit ML-DSA records as future steps, not current capabilities (Cloudflare).

This matters because DNSSEC is only as strong as its weakest link. A quantum attacker who could forge a classical signature higher in the chain could redirect traffic before any post-quantum check lower down begins.

Cloudflare has built in an anti-downgrade rule to address part of this problem. If a parent zone declares that ML-DSA is required, 1.1.1.1 will reject an answer validated only with older cryptography. That prevents silent removal of the new protection below that point (Cloudflare). The protection only applies, of course, below wherever post-quantum signing actually begins.

The specification binding ML-DSA to DNSSEC record formats remains an active IETF working-group draft, so the operating format is still being negotiated.

Unlike encrypted traffic, signed DNS records are public. There is no "harvest now, decrypt later" urgency: nobody can stockpile today's DNS answers and forge them with a future quantum machine. The risk is future forgery at the moment it happens. But migrating DNS requires coordination across root operators, registries, registrars, authoritative servers, resolver software and network equipment that may choke on oversized packets or blocked TCP connections. Starting early gives the ecosystem room to discover problems before they matter.

The deployment could provide a real-world testing platform for exactly those problems, revealing where TCP fallback fails or where equipment drops large replies. Cloudflare has shown that a production public resolver can validate an ML-DSA-signed DNS answer after falling back to TCP. It has not shown how reliably or quickly that path works under representative load.