Post-Quantum DNSSEC Is a Packet-Size Migration Before It Is a Crypto Migration

Post-quantum DNSSEC sounds like a cryptography story. It is, eventually. The first operational problem is much more ordinary: the packet no longer fits the assumptions that have accumulated around DNS.

Cloudflare has enabled ML-DSA-44 DNSSEC validation in 1.1.1.1. The signature is 2,420 bytes. A lot of DNS software has spent years behaving cautiously around a UDP payload of roughly 1,232 bytes. One signature has already blown past the budget before the response includes a key, record set, or header. That is not a reason to dismiss post-quantum work. It is exactly why the work has to start before the threat becomes immediate.

DNSSEC Protects Answers, Not Secrecy

DNSSEC gives a resolver a way to validate that a DNS answer belongs to the signed chain from the root to the zone being queried. It protects authenticity. It does not encrypt DNS traffic and it does not make a domain inherently safe. The useful failure it prevents is a forged answer that points a user to an attacker-controlled address.

That chain is also why the migration is not a switch one operator can flip. A post-quantum path needs support from authoritative servers, registrars, registries, parent zones, validators, and eventually the root trust anchor. A strong key in a child zone does not repair a weak link higher in the delegation path.

ML-DSA-44 Changes the Shape of the Response

Cloudflare's comparison makes the practical difference clear. An ECDSA P-256 signature is 64 bytes. ML-DSA-44 is 2,420 bytes. Its public key is 1,312 bytes. DNSSEC answers can therefore grow well beyond the conservative UDP sizes engineers have learned to take for granted.

Fragmentation Is Not the Plan

Large fragmented UDP answers are unreliable in the wild. Networks, middleboxes, and firewalls have opinions about fragments, and those opinions are rarely written down in a runbook. The expected pattern is a truncated UDP reply followed by a resolver retry over TCP. That fallback is old DNS behavior, but the post-quantum transition makes it a much more common path worth testing deliberately.

Test the Actual Network

Do not infer success from a resolver running in a lab. Measure response sizes, observe whether truncation happens as expected, verify TCP fallback across your authoritative service and resolver fleet, and look for paths that silently time out. A migration plan that depends on transport behavior has to include the transport operators.

Compatibility Cannot Become a Downgrade

For years, zones will need to serve conventional algorithms alongside newer ones. Older resolvers need to keep working. The dangerous interpretation is that a modern resolver can simply accept the old signature whenever the new validation path fails.

Cloudflare describes a more restrictive local policy for its post-quantum experiment: where a post-quantum path is published and required, a conventional path alone is not enough. That distinction is the heart of downgrade resistance. Compatibility is useful. Compatibility that lets an attacker substitute a weaker chain is not.

Key Rotation Does Not Solve the Delegation Problem

It is tempting to answer a future cryptographic threat with more frequent key rotation. Rotation is good hygiene, but it does not solve the structural problem. If an attacker can forge a vulnerable key higher in the delegation path, they can create a believable path below it. The migration must reach the root, not merely refresh keys at the leaves.

A Practical Operator Checklist

Start with the boring evidence. Inventory authoritative DNS providers, resolver software, DNSSEC algorithms, EDNS behavior, TCP fallback, firewall rules, registrar workflows, and the people allowed to change each layer. Then add a test zone and measure it from networks that do not resemble your office connection.

publish test records
  -> measure UDP response and truncation
  -> confirm TCP retry succeeds
  -> validate the signed delegation path
  -> test failure and downgrade behavior
  -> record ownership and rollback conditions

The point is not to make every zone post-quantum tomorrow. It is to find the packet and policy assumptions now, while a failure is a useful test rather than a production security event.

The Migration Is Already Operational Work

Cloudflare's rollout is valuable because it puts real traffic behind the question. ML-DSA-44 is standardized, but Internet deployment is still a coordination problem. Bigger signatures create bigger responses. Bigger responses force transport paths into the open. Mixed algorithms create downgrade questions. Every one of those belongs to network engineering as much as cryptography.

The future quantum computer is not in the room today. The DNS packet is. That gives operators something concrete to measure, fix, and own before the security deadline becomes a pager problem.

---