Limits
Comparable servers, not Cloudflare’s origins
Section titled “Comparable servers, not Cloudflare’s origins”The study measures origins at the head of the web that aren’t on Cloudflare, Akamai, Fastly or CloudFront. They’re comparable to the servers behind Cloudflare, but they aren’t the origins Cloudflare connects to, and their PQ share isn’t Cloudflare’s number. What transfers is the cause mix: why servers like these aren’t post-quantum.
The upper bound
Section titled “The upper bound”“Fixing the top 3 causes moves 25.5% to 98.4%” counts each fixable host as post-quantum once its cause is fixed. The fix lab shows the printed fix turning real OpenSSL and Go servers with the same fault post-quantum. It doesn’t show that every owner here can apply it. Some servers can’t be upgraded quickly; that’s what the Cloudflare Tunnel fallback is for.
The head of the web
Section titled “The head of the web”Every non-CDN origin in the Tranco top 10k, not a random sample of all servers. The top 1,000 is higher; below that the share is flat across ranks. Small sites outside any top list aren’t measured.
One vantage point, one address
Section titled “One vantage point, one address”IPv4 only, the first A record, from one machine. Anycast or geo-DNS origins may answer differently elsewhere.
Redirectors count
Section titled “Redirectors count”Tranco ranks registrable domains. The probe goes to the domain itself, or www. when the bare domain has no address. So some entries are API, CDN or tracking hostnames rather than websites, and those mostly land in “no TLS answer”. Some TLS 1.2 apexes are leftover redirect servers in front of CDN-hosted sites.
Servers change
Section titled “Servers change”The scan took about 80 minutes. At least one host (kaufland.de) switched between PQ and not-PQ within minutes, so any single host’s verdict is a snapshot.
The Server header
Section titled “The Server header”The software counts come from the HTTP Server header, which is often missing or generic. “unknown” is the largest group.