1.1.1.1 now supports post-quantum DNSSEC
nbcnews.com
1 thread
Note that 1.1.1.1 is a validating resolver. Some zone still needs to sign using the algorithm. That number is basically zero once you remove test zones.
Still, there will be a migration to PQC as in other protocols. DNS doesn't have the same "store and decrypt later" threat, so it could be a lower priority over other protocols in use.
There's no store-now/decrypt-later, but DNS is notoriously slow to make any changes. Better start early. We're running probes from our challenge pas to the test zone, so we see how much breaks with these large signatures. If things look good, we can roll out ML-DSA-44 by default on all Cloudflare signed zones.