Add post-quantum DNSSEC support (ML-DSA, SLH-DSA) to the built-in dnssec plugin

France's ANSSI will stop certifying non-PQC products from 2027. The US Executive Order 14409 mandates PQC for all federal systems, with key establishment by 2030 and digital signatures by 2031. Australia's ASD/ACSC has published post-quantum vendor guidance urging organizations to assess PQC readiness across their supply chain.

Context

CoreDNS runs in every Kubernetes cluster as the default DNS server. Its built-in dnssec plugin currently supports ECDSAP256SHA256 and RSA signature algorithms. DNSSEC signing is a prime target for PQC migration because DNS responses with forged signatures could redirect traffic at scale.

An academic team has built a working PQC DNSSEC CoreDNS plugin (IEEE S&P 2024), demonstrating feasibility with ML-DSA and SLH-DSA. However, this work has not been upstreamed into mainline CoreDNS.

IETF work on PQC DNSSEC is progressing:

• draft-fregly-dnsop-slh-dsa-mtl-dnssec (SLH-DSA with Merkle tree ladders for smaller signatures)
• NIST IR 8547 deprecates RSA/ECDSA by 2030

Proposal

1. ML-DSA support: Add ML-DSA-44/65 as DNSSEC signing algorithms in the dnssec plugin
2. SLH-DSA support: Add SLH-DSA (FIPS 205) for stateless hash-based signing
3. Configuration: New algorithm identifiers in the Corefile dnssec block
4. Performance testing: PQC signatures are larger; measure impact on DNS response sizes and latency

References

• NIST FIPS 204 (ML-DSA)
• NIST FIPS 205 (SLH-DSA)
• IEEE paper: PQC DNSSEC with CoreDNS
• US Executive Order 14409
• Australia ASD PQC Vendor Guidance