From bas at cloudflare.com  Tue Sep  1 10:44:47 2026
From: bas at cloudflare.com (Bas Westerbaan)
Date: Tue, 1 Sep 2026 12:44:47 +0200
Subject: 1.1.1.1 supports ML-DSA-44 (alg 18)
Message-ID: <CAMjbhoVxviN=shNKJUPwAZ6AYsxJBDa9N3ZbLEZcaZ=2kxJY4Q@mail.gmail.com>

Hey all!

Yesterday we rolled out support for ML-DSA-44 (alg 18) in 1.1.1.1 turned on
by default. We also insist on alg 18 signatures if an alg 18 key is
advertised in a DS (even if other algorithms are available) to prevent
future downgrades.

dig @1.1.1.1 +dnssec only.alg18.westerbaan.name
dig @1.1.1.1 +dnssec downgrade.alg18.westerbaan.name

This all of course doesn't make any difference today as there basically
aren't any alg 18 signed zones yet except for the odd test zone.

Best,

 Bas
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20260901/c073a95a/attachment.html>

From fneves at registro.br  Tue Sep  8 16:53:59 2026
From: fneves at registro.br (Frederico A C Neves)
Date: Tue, 8 Sep 2026 13:53:59 -0300
Subject: [dns-operations] 1.1.1.1 supports ML-DSA-44 (alg 18)
In-Reply-To: <mailman.3341.1788880639.9132.dns-operations@lists.dns-oarc.net>
References: <mailman.3341.1788880639.9132.dns-operations@lists.dns-oarc.net>
Message-ID: <aqA9p68kvBcvxIKI@registro.br>

Bas,

On Tue, Sep 01, 2026 at 12:44:47PM +0200, Bas Westerbaan via dns-operations wrote:
> Date: Tue, 1 Sep 2026 12:44:47 +0200
> From: Bas Westerbaan <bas at cloudflare.com>
> To: dns-operations at lists.dns-oarc.net
> Subject: 1.1.1.1 supports ML-DSA-44 (alg 18)
>
> Hey all!
>
> Yesterday we rolled out support for ML-DSA-44 (alg 18) in 1.1.1.1 turned on
> by default. We also insist on alg 18 signatures if an alg 18 key is
> advertised in a DS (even if other algorithms are available) to prevent
> future downgrades.
>
> dig @1.1.1.1 +dnssec only.alg18.westerbaan.name
> dig @1.1.1.1 +dnssec downgrade.alg18.westerbaan.name
>
> This all of course doesn't make any difference today as there basically
> aren't any alg 18 signed zones yet except for the odd test zone.
>

Nice,

Not that it would make any transport difference but if the KEYSETs
were signed only by the KSKs that would be closer to a more realistic
signed zone operation.

> Best,
>
>  Bas

Fred

From bas at cloudflare.com  Tue Sep  8 18:50:21 2026
From: bas at cloudflare.com (Bas Westerbaan)
Date: Tue, 8 Sep 2026 20:50:21 +0200
Subject: [dns-operations] 1.1.1.1 supports ML-DSA-44 (alg 18)
In-Reply-To: <aqA9p68kvBcvxIKI@registro.br>
References: <mailman.3341.1788880639.9132.dns-operations@lists.dns-oarc.net>
 <aqA9p68kvBcvxIKI@registro.br>
Message-ID: <CAMjbhoX31XfR7rw3ancWHwyWB2tdHrXW9PRApidZG1-1fzFosA@mail.gmail.com>

>
> Nice,
>
> Not that it would make any transport difference but if the KEYSETs
> were signed only by the KSKs that would be closer to a more realistic
> signed zone operation.
>

Thanks, updated.

Best,

 Bas
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.dns-oarc.net/pipermail/dns-operations/attachments/20260908/40cc0763/attachment.html>