Breaking Lab srl
Why DNS security matters for your site
Every time someone types your domain name into a browser, the internet has to look up which server to send them to. That lookup is handled by DNS — the Domain Name System, which works like a phone book for the web. DNSSEC is a layer on top of DNS that adds digital signatures, so browsers can confirm the answer has not been tampered with in transit. Without it, attackers can quietly redirect visitors to fake servers.
Cloudflare’s 1.1.1.1 is one of the most widely used public DNS resolvers on the internet, meaning a huge share of web traffic passes through it. This week, Cloudflare switched it on to validate those DNS signatures using a post-quantum algorithm called ML-DSA-44, developed by the US standards body NIST.
What “post-quantum” actually means here
Today’s encryption relies on maths that is easy for normal computers to check but very hard to crack. Quantum computers — machines that exploit the strange rules of quantum physics — will eventually be fast enough to break those calculations. The timeline is genuinely uncertain, but large organisations are already moving to algorithms that even a quantum computer would struggle with. ML-DSA-44 is one of those algorithms.
The practical cost is size. A standard DNSSEC signature is a few dozen bytes. An ML-DSA-44 signature is 2,420 bytes — roughly 50 times bigger. For a resolver handling hundreds of billions of queries a day, that is not a small change. Cloudflare has had to rework how it manages signature caching, handles larger DNS packets, and protects users whose network equipment quietly drops oversized responses.
What this means if you run a website
If your domain already has DNSSEC enabled, visitors resolving through 1.1.1.1 now get a stronger guarantee that your DNS records are genuine. You do not need to do anything yourself today — this upgrade lives on the resolver side, not on your registrar or hosting panel.
However, this is a signal worth paying attention to. Major DNS providers are clearly treating post-quantum readiness as a near-term engineering priority, not a theoretical future concern. If you have been putting off enabling DNSSEC at all, this is a good moment to check whether your registrar supports it. Most do, and turning it on takes minutes.
The road ahead
Post-quantum cryptography is spreading fast across the web’s foundations — TLS, SSH, and now DNS. For site owners, the practical implication is that infrastructure choices made in the next two or three years will determine how well protected your visitors are when quantum hardware becomes widely available. Keeping DNSSEC enabled and staying with providers that track these standards is the lowest-effort way to stay on the right side of that curve.
