Poster: Hybrid Signatures for Post-Quantum DNSSEC: A Real-World Evaluation

Abstract

The Domain Name System (DNS) is a core Internet protocol, but its lack of built-in authenticity and integrity protections makes it vulnerable to attacks. Although DNSSEC mitigates this issue through the use of cryptographic signatures, those signatures may be threatened by advances in quantum computing. NIST's Post-Quantum (PQ) signatures provide quantum resistance but come with challenges: their larger sizes often exceed the Maximum Transmission Unit (MTU), forcing inefficient TCP fallbacks and slowing DNS resolution. To bridge theory and real-world deployment, we introduce two innovations: a modified version of commercial DNS software supporting hybrid signatures (classical and PQ) and UDP fragmentation for smooth coexistence during the transition, and a real-world testbed for empirical evaluation under diverse network conditions. We open-source our software and testbed to promote reproducible research and pave the way for quantum-safe DNS in live environments.