Summary

  • Cloudflare’s 1.1.1.1 resolver could validate ML-DSA-44 signatures for test zones from 10 September 2026. Joe Abley’s RIPE 93 browser challenge compared classical and dual-signed DNSSEC paths.
  • In validating resolvers, dual-signed versus classical control showed +1 ms at the median and +1,405 ms at p99. The slides labeled aggregate net breakage at 6.0%; the early, noisy test did not establish a population failure rate.

The quiet middle, the expensive tail

A median of one millisecond is the number an upgrade announcement would print in large type. Joe Abley’s Cloudflare experiment had a less comfortable line below it: the dual-signed path was 1,405 milliseconds slower than the classical control at p99. That is the edge of the distribution where a small group of users waits while everyone else makes the average look tidy.

The graph in the original RIPE 93 slides compares elapsed time for dual-signed DNSSEC minus an algorithm-13 control among validating resolvers. The differences were +1 ms at the median, +147 ms at p90, +618 ms at p95 and +1,405 ms at p99. These are browser-challenge measurements, not a stopwatch attached only to cryptographic verification. Abley also showed a broken-classical-signature path against the control as a non-validating baseline: 0, +73, +215 and +1,132 ms at the same percentiles.

The numbers came from about 140,000 data points, gathered by showing a browser challenge to one in every 1,000 users. Each challenge launched four parallel HTTPS fetches from Cloudflare-served DNS names: a classical algorithm-13 control, a deliberately broken algorithm-13 signature, an ML-DSA-44 path using algorithm 18, and a name signed with both algorithms. Slide 19 called the aggregate validating result “net breakage” of 6.0%. Abley said roughly 20 autonomous systems showed significantly higher breakage; most observed ASes showed no difference. The talk did not publish a cause for each failure.

A new signature can veto the old escape hatch

The experiment was possible because 1.1.1.1 had ML-DSA-44 validation live for all clients from 10 September, using test zones. That was validation support, not a customer launch of quantum-safe signing. The IANA registry lists algorithm 18 as ML-DSA-44, with signing and validation marked MAY. It lists algorithm 13, ECDSA P-256 with SHA-256, as RECOMMENDED.

Ordinary DNSSEC gives a resolver room to accept an RRset when any covering RRSIG validates. RFC 6840 says a resolver should accept any valid signature and mark the RRset bogus only when all signatures fail; RFC 4035 leaves conflict handling to local security policy. Cloudflare’s stricter quantum-safe rule closes that escape hatch: when an algorithm-18 signature is present, it must validate. A valid algorithm-13 signature cannot rescue a broken ML-DSA-44 one. The point is to stop an attacker from turning a quantum-safe upgrade into a quiet downgrade to the classical signature.

That protection makes the new signature an availability condition. If it is malformed, users can lose an answer that the classical signature alone would have authenticated. The distinction belongs to resolver policy, not a change to DNSSEC’s base protocol.

The browser was not a clean room

Abley called the results very early and noisy. The same DNS names were reused, so caches could affect the comparison; the challenge did not bust cache. HTTPS redirects added time. Users who completed quickly could leave the measurement early, and a two-second timeout clipped slow requests. Home networks and browser conditions added their own noise. The slides therefore show a warning signal, not a clean allocation of every failure to ML-DSA validation.

The deployment decision was still open. Cloudflare was experimenting with online ML-DSA-44 signing and had not set a customer availability date. Compliance requirements could create demand for opt-in signing; dual-signing by default would require high confidence that it would not break service. Abley’s individual Internet-Draft proposes an Extended DNS Error signal so clients can distinguish a resolver’s strict local policy from an unexplained negative answer.

A cache-busted, randomized replay with resolver-level traces would change the deployment judgment: it could separate DNS validation failures from redirects, browser exits and timeouts. Until then, the important result is the shape of the test: nearly flat in the middle, steep at the tail, and a policy that makes the quantum-safe signature count.

Sources