<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN"><html><head><meta content="text/html;charset=UTF-8" http-equiv="Content-Type"></head><body ><div style="font-family: Verdana, Arial, Helvetica, sans-serif; font-size: 12pt; color: rgb(0, 0, 0);"><div>Hi,<br></div><div><br></div><div>I tested my dnsdist instance using <a href="https://github.com/testssl/testssl.sh" target="_blank">testssl</a> and it reports that KEMs are offered (X25519MLKEM768). Using a EC 384 bits Lets Encrypt certificate. Haven't done sniffing to see whether the KEMs are actually used by clients though.<br></div><div><br></div><div>FWIW, testssl also reports that dnsdist is offering Obsoleted CBC ciphers (AES, ARIA etc.)</div><div><br></div><div>Marcos</div><div><br></div><div class="zmail_extra_hr" style="border-top: 1px solid rgb(204, 204, 204); height: 0px; margin-top: 10px; margin-bottom: 10px; line-height: 0px;"><br></div><div class="zmail_extra" data-zbluepencil-ignore="true"><div><br></div><div id="Zm-_Id_-Sgn1">---- On Mon, 12 Jan 2026 16:17:31 +0200 <b>Remi Gacogne via dnsdist <dnsdist@mailman.powerdns.com></b> wrote ---<br></div><div><br></div><blockquote style="margin: 0px;" id="blockquote_zmail"><div>Hi Christoph, <br> <br>On 1/10/26 00:42, Christoph via dnsdist wrote: <br>> someone reached out to us and asked whether we could support <br>> post-quantum safe TLS 1.3 options on our public resolvers. <br>> <br>> Since most browsers have support for X25519MLKEM768 <br>> <a target="_blank" href="https://developers.cloudflare.com/ssl/post-quantum-cryptography/pqc-">https://developers.cloudflare.com/ssl/post-quantum-cryptography/pqc-</a> <br>> support/ <br>> and openssl 3.5 in debian stable supports it, <br>> I was wondering how to enable it in dnsdist <br>> but I didn't find any parameter in addDOHLocal() <br>> to configure ECDHE curves? <br>> <a target="_blank" href="https://www.dnsdist.org/reference/config.html#addDOHLocal">https://www.dnsdist.org/reference/config.html#addDOHLocal</a> <br>> <br>> Is this currently supported? <br> <br>I don't think we have any way to configure this today, no. I opened an <br>issue [1] on our bug tracker. If it's as easy as it seems to be I would <br>be ready to backport this change to 2.0.x. <br> <br>[1]: <a target="_blank" href="https://github.com/PowerDNS/pdns/issues/16715">https://github.com/PowerDNS/pdns/issues/16715</a> <br> <br>Best regards, <br> <br>-- <br>Remi Gacogne <br>PowerDNS.COM BV - <a target="_blank" href="https://www.powerdns.com/">https://www.powerdns.com/</a> <br>_______________________________________________ <br>dnsdist mailing list <br><a target="_blank" href="mailto:dnsdist@mailman.powerdns.com">dnsdist@mailman.powerdns.com</a> <br><a target="_blank" href="https://mailman.powerdns.com/mailman/listinfo/dnsdist">https://mailman.powerdns.com/mailman/listinfo/dnsdist</a> <br></div></blockquote></div><div><br></div></div><br></body></html><br><div><br></div><div><span class="size" style="font-size: 10.666666666666666px"><i>The content of this email is confidential and intended for the recipient specified in message only. It is strictly forbidden to share any part of this message with any third party, without a written consent of the sender. If you received this message by mistake, please reply to this message and follow with its deletion, so that we can ensure such a mistake does not occur in the future.</i></span><br></div>