Post-quantum DNSSEC / packet inspection
A bigger signature.
A different byte budget.
See exactly what fills a DNS response. Inspect ML-DSA-44 signatures, compare UDP budgets and separate truncation from validation.
DNS byte inspector
Local processing · free · no uploadRecorded public sample / 15 October 2026
Counted from recorded wire bytes
The full message exceeds this budget.
Byte fit does not establish delivery, path MTU or DNSSEC validation.
Signature Headers & metadata Other data
Observed OPT UDP size: 1232 bytes.
Where the bytes go
| Component | Bytes | Share |
|---|---|---|
| Signature bytes | 2420 | 94.4% |
| All other fields | 143 | 5.6% |
Size-only comparison
JavaScript calculates the effect of changing only the signature byte count.
- This page does not verify signatures or trust chains.
Record offsets & algorithms
Offsets are zero-based, inclusive, within the DNS message. Record sizes include their envelope.
| Name | Section / type | Byte offsets | Bytes | Algorithm |
|---|
Raw bytes, record values and input filenames are excluded. Privacy details
Start with the evidence
Three questions.
Three different answers.
Did the whole answer arrive?
Read the 54-byte truncated reply beside the 2,563-byte TCP response.
02What does algorithm 18 prove?
A record type, a resolver assertion and a verified trust chain are different evidence.
03Does the application still work?
Follow a DNS change with independent website and test-email observations.
Why this exists now
Cloudflare announced ML-DSA-44 validation in its 1.1.1.1 resolver on September 10, 2026. That gives operators a public way to explore larger DNSSEC messages. WireBudget adds a local accounting view: inspect actual byte ranges and keep observations separate from assumptions. Read the resolver announcement and our methods and limits.
You can inspect supplied bytes without changing any DNS setting. The browser makes no DNS probes. The default result is a dated public capture; it says nothing about the resolver or network you are using today.