“One way to quantum-proof DNSSEC is to use larger keys that even a quantum computer will struggle to crack.”
ICANN CTO John Crain used to give DNS ten years to get quantum safe. Now he says three or five. Bigger keys mean bigger responses, which pushes DNS off single UDP packets and onto TCP, and Crain says that move alone takes a few years. The deadline got cut in half and the plan is still “preliminary work.”