[dns-operations] 1.1.1.1 supports ML-DSA-44 (alg 18)

[Frederico A C Neves]

Bas,

On Tue, Sep 01, 2026 at 12:44:47PM +0200, Bas Westerbaan via dns-operations wrote:
> Date: Tue, 1 Sep 2026 12:44:47 +0200
> From: Bas Westerbaan <bas at cloudflare.com>
> To: dns-operations at lists.dns-oarc.net
> Subject: 1.1.1.1 supports ML-DSA-44 (alg 18)
>
> Hey all!
>
> Yesterday we rolled out support for ML-DSA-44 (alg 18) in 1.1.1.1 turned on
> by default. We also insist on alg 18 signatures if an alg 18 key is
> advertised in a DS (even if other algorithms are available) to prevent
> future downgrades.
>
> dig @1.1.1.1 +dnssec only.alg18.westerbaan.name
> dig @1.1.1.1 +dnssec downgrade.alg18.westerbaan.name
>
> This all of course doesn't make any difference today as there basically
> aren't any alg 18 signed zones yet except for the odd test zone.
>

Nice,

Not that it would make any transport difference but if the KEYSETs
were signed only by the KSKs that would be closer to a more realistic
signed zone operation.

> Best,
>
>  Bas

Fred