# 1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it

DevFeed: [1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it](<https://devfeed.tech/articles/1-1-1-1-now-supports-post-quantum-dnssec-all-2-420-bytes-of-it-117.md>)

Original publisher: [Read original article](<https://blog.cloudflare.com/post-quantum-dnssec-1111/>)

Author: Bas Westerbaan

Published: 2026-09-10T13:00:00Z

Content type: article

Language: en

Sources: [Cloudflare Blog](<https://devfeed.tech/sources/cloudflare-blog.md>)

Topics: [Cryptography](<https://devfeed.tech/topics/cryptography.md>)

Tags: [1-1-1-1](<https://devfeed.tech/tags/1-1-1-1.md>), [algorithms](<https://devfeed.tech/tags/algorithms.md>), [cryptography](<https://devfeed.tech/tags/cryptography.md>), [dns](<https://devfeed.tech/tags/dns.md>), [dnssec](<https://devfeed.tech/tags/dnssec.md>), [post-quantum](<https://devfeed.tech/tags/post-quantum.md>), [research](<https://devfeed.tech/tags/research.md>), [security](<https://devfeed.tech/tags/security.md>), [testing](<https://devfeed.tech/tags/testing.md>), [tls](<https://devfeed.tech/tags/tls.md>), [validation](<https://devfeed.tech/tags/validation.md>)

## AI overview

Cloudflare's 1.1.1.1 now validates DNSSEC signatures using the post-quantum ML-DSA-44 algorithm. The article discusses testing oversized DNS responses and preventing downgrade to conventional signatures while retaining compatibility with older resolvers.

## Source excerpt

1.1.1.1 now validates DNSSEC signatures using NIST's post-quantum ML-DSA-44 algorithm. Here is how we manage 2,420-byte signatures and downgrade risks at scale.