This is great news for those of us who want to see DNSSEC more widely deployed for three reasons: 1. CloudFlare already hosts the DNS for millions of domains.

This is great news for those of us who want to see DNSSEC more widely deployed for three reasons: 1. CloudFlare already hosts the DNS for millions of domains. This is now making it VERY easy for those who use CloudFlare to sign their domains with DNSSEC. 2. Because of the competition within the DNS hosting / operator space, this move by CloudFlare will hopefully motivate the other large DNS operators to simplify their own user experience for DNSSEC. 3. For those of us who want to see stronger crypto within DNSSEC, this move by CloudFlare advances the use of an elliptic curve algorithm. Yes, ECDSA has its issues, but by getting it out there: a) it gets people looking at EC algorithms; and b) it gets software providers realizing they need to have their user interfaces adaptable to incorporate more DNSSEC algorithms. (I.e. to realize the list is NOT fixed and will grow over time.) As I said in another comment ( https://news.ycombinator.com/item?id=10553383 https://news.ycombinator.com/item?id=10553383 ) there is a draft out there to add Ed25519 as a DNSSEC algorithm: https://tools.ietf.org/html/draft-sury-dnskey-ed25519-01 https://tools.ietf.org/html/draft-sury-dnskey-ed25519-01 This draft needs to be approved through the IETF working groups - and then deployed on both the signing and validation sides of DNSSEC. This will take quite some time and so we need to start as soon as we can.