I was debugging something completely unrelated last night (a Pi-hole that kept forgetting its upstream server after reboots, don't ask) when I noticed a line in my resolver logs I didn't recognize. Turned out Cloudflare quietly flipped a switch on 1.1.1.1 yesterday: as of September 10th, their public resolver started actually validating DNSSEC signatures that use ML-DSA-44, which is the post-quantum signature algorithm NIST standardized last year as part of FIPS 204. I went looking for the announcement and it's maybe four paragraphs on their blog. No fanfare, no press tour. Just "hey, we can check these signatures now too."
If you don't spend your evenings staring at dig output, here's the short version. DNSSEC is the thing that stops someone from forging DNS responses and sending you to a fake bank login page while your browser thinks everything's fine. It works by signing DNS records, and up until now those signatures were basically all RSA or ECDSA, both of which a sufficiently large quantum computer could theoretically break. Nobody has that computer yet, not even close, but the crypto community has spent the last few years moving to "post-quantum" algorithms anyway, on the theory that you want the plumbing in place years before you actually need it. ML-DSA is one of those algorithms, built on lattice math instead of factoring or elliptic curves. 1.1.1.1 validating it is a small, boring, genuinely important step.
I say boring and I mean it as a compliment. This is exactly how infrastructure security should ship: quietly, as a validation capability that doesn't break anything for anyone still signing with the old stuff. Compare that to how every "post-quantum" story gets covered elsewhere, with a stock photo of a glowing chip and a headline implying your bank account gets drained next Tuesday. It doesn't. This is Cloudflare adding support for checking a newer kind of math homework, that's it.
So naturally I went and checked whether my own domain could even use this, and the answer was an embarrassing no. I run techpad's DNS through Tricknowtech (I've mentioned tricknow.tech here before for hosting and deploys, same account), and as of this week their DNS panel doesn't expose an ML-DSA signing option at all, just the usual RSA/SHA-256 for DNSSEC. Which, fine, this stuff rolled out two days ago, I'm not expecting every registrar on earth to have it Tuesday morning. But it made me realize I've had DNSSEC signing turned off on this domain for something like four years because it once caused a resolution outage during a key rollover and I never worked up the nerve to turn it back on. Four years! That's not a post-quantum problem, that's a me problem.
I spent about forty minutes going down the rabbit hole of which resolvers support what. Quad9 doesn't validate ML-DSA yet as far as I can tell. Google's 8.8.8.8, also no, at least not that they've said publicly. So right now this is really a Cloudflare-only party, which matters less than it sounds like because almost nothing is actually signing with ML-DSA on the authoritative side yet either. It's validation support waiting for adoption that hasn't happened, which is sort of the story of every post-quantum rollout so far. TLS 1.3 got a hybrid key exchange option back in September too (Java 27 shipped with it under JEP 527, if you're into that kind of thing), and it's the same pattern: the receiving end gets ready first, the sending end catches up over years.
What actually got me a little excited, and I don't say that about DNS infrastructure often, is that this is the first time I've seen post-quantum crypto land somewhere I personally touch every single day instead of staying in the "NIST published a PDF" phase. I've read about ML-KEM and ML-DSA for two years in the abstract and never once had a reason to run a command against them. Last night I did. It didn't do anything interesting, the validation just succeeded silently like DNSSEC checks always do when they work, but there's something satisfying about poking at a thing that was theoretical math a few years ago and is now sitting in a production resolver answering queries for half the internet.
I'm going to go turn DNSSEC back on for this domain this weekend, four-years-ago-me's outage be damned. If it breaks again I'm blaming the raccoon that's been getting into the trash cans lately, mostly because he's been getting blamed for everything else around here this month anyway.