On September 10, 2026, Cloudflare announced ML-DSA-44 validation on 1.1.1.1. This enables the resolver to verify those DNSSEC signatures; full post-quantum protection also requires adoption throughout the trust chain. Cloudflare announcement.
What does a DNSSEC signature protect?
DNS translates names into information used to locate services. DNSSEC adds authentication: a resolver checks signatures and the relationship between a zone and its parent before treating data as secure.
This helps detect modified answers. It does not conceal queries from a network observer: authenticity and confidentiality are different properties. DoH and DoT address encrypted transport; DNSSEC authenticates the data. RFC 4033 explains that distinction.
What is ML-DSA?
ML-DSA is a lattice-based digital signature standard published by NIST as FIPS 204. It is designed to resist adversaries with large-scale quantum computers. It signs data rather than encrypting query contents. NIST standard.
Two questions matter to readers: does the resolver understand the signature, and does the chain linking the domain to its trust anchor provide the necessary protection? Support at one step does not establish deployment everywhere else.
Larger responses can affect transport
The announcement lists 2,420 bytes for an ML-DSA-44 signature. That size illustrates why migration also requires network engineering.
RFC 9715 explains that large DNS messages over UDP risk IP fragmentation. Limiting response sizes and signaling a retry over TCP can avoid fragmentation.
When investigating a large answer, check the truncation bit, TCP reachability, and size limits along the path. Retrying over another transport can add steps to a lookup. This is an operational possibility rather than a prediction that every user will experience slower DNS.
Evaluate performance on your connection
We recommend separating availability measurements from cryptographic investigation:
- Compare resolvers on the same network within the same time window.
- Repeat measurements and record failures, median latency, P95, and jitter where available.
- Keep the domain set and cache conditions consistent.
- For a technical investigation, also inspect signatures, transport, and resolver logs.
A fast answer for an ordinary domain does not prove post-quantum support. A single slow query does not establish the algorithm as the cause either. Our Cloudflare, Quad9, and Google comparison can help frame local testing.
How does this relate to October’s root key rollover?
The KSK-2024 rollover replaced a key at the DNS root. Post-quantum signatures are a separate development. Follow both without interpreting a rollover as evidence of an Internet-wide algorithm migration.
Choosing a home DNS resolver still involves availability, privacy, compatibility, and local measurements. This validation capability adds a security consideration; it does not replace benchmarking.
