FireTofu
1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it

Technology · en

1.1.1.1 now supports post-quantum DNSSEC, all 2,420 bytes of it

Cloudflare Blog · Official source · Sep 10, 2026, 1:00 PM UTC

1.1.1.1 now validates DNSSEC signatures using NIST’s post-quantum ML-DSA-44 algorithm. Here is how we manage 2,420-byte signatures and downgrade risks at scale.