Cloudflare brings DNS into the post-quantum era: Internet security must change before the computer capable of breaking it arrives

Modern cryptography lives in a strange race against the future. Today, many algorithms are secure because currently available computers cannot solve certain mathematical problems in a feasible timeframe. A sufficiently powerful quantum computer could alter this balance.

Cloudflare has announced support for post-quantum DNSSEC on its 1.1.1.1 resolver. The curious detail is that the new signatures are significantly larger: the company points to packets that can reach around 2,420 bytes. But the real issue is not size. It is the fact that one of the Internet's most invisible infrastructures is already preparing a migration for a threat that is not yet fully operational.

DNS is an address book, but it is also a target

When we type in a domain, DNS translates that name into a network address. If someone manages to manipulate that response, they can redirect the user to the wrong infrastructure. DNSSEC adds cryptographic signatures to allow verification that the information has not been altered.

The problem is that part of the cryptography used today could be vulnerable to future quantum computers. Hence the need for algorithms designed to withstand that type of computation as well.

Migration is harder than mathematics

Devising a secure algorithm is not enough. The Internet is built on protocols, routers, legacy systems, firewalls, and software that must keep talking to one another. A larger signature may seem irrelevant, but at global scale, every byte and every incompatibility counts.

Cryptographic transitions take years precisely because they must occur without breaking the infrastructure. The greatest risk is not just choosing the wrong algorithm: it is discovering that a portion of the network cannot handle the change.

Harvest now, decrypt later

There is also a reason why preparation must start early. An attacker can collect encrypted data today and store it in the hope of decrypting it in the future, when better tools are available. This is the principle known as “harvest now, decrypt later”.

For information that must remain confidential for many years, the future threat is therefore already a present threat.

The best security is the one that arrives before panic

The transition to post-quantum will likely be largely invisible to most users. No new buttons, no flashy interfaces. But that is precisely how well-designed infrastructure works: it changes before we are forced to notice.

Cloudflare is not saying that a quantum computer will break the Internet tomorrow. It is doing something more pragmatic: eliminating ahead of time a dependency on algorithms that may one day no longer be sufficient.

Cybersecurity often tends to intervene after an incident. The post-quantum migration forces us to do the opposite instead: design a defense against an attack that, if we wait to actually see it happen, may already be too late.