Post-Quantum DNSSEC at Cloudflare#

Joe Abley, Cloudflare

• Why: The first production deployment of a post-quantum DNSSEC algorithm in a large public resolver — a working answer to "how do we even start?" for PQ migration of Internet infrastructure.
• What: Cloudflare implemented ML-DSA-44 (algorithm 18, via draft-westerbaan-dnssec-mldsa) in the 1.1.1.1 resolver, fully live for all clients since 10 September 2026, handling 2,420-byte signatures; a public checker (dnstest.dev) tells users what their local resolver does. The wider landscape remains at zero: no PQ algorithms specified for DNSSEC, no registries accepting PQ DS records, root still on RSA/SHA-256 — and the response-size/TCP-fallback problem is the gating issue.
• How: Implementation and measurement experience, plus a new problem class: DNSSEC has no downgrade protection, and a failing PQ signature alongside a valid legacy signature is indistinguishable from a quantum attack — motivating draft-jabley-dnsop-local-signing-algorithm-policy for local validation policy. Framed against NIST IR 8547's ~2030 deprecation and 2035 disallowance clock.
• Where applicable: DNS operators and anyone planning PQC timelines for signing infrastructure; the multi-signature downgrade problem generalizes to other PQ migrations.