Results

All shares are of the 4,616 origins that answered TLS. See Method for how they were chosen.

Verdicts

Verdict	Hosts	Share
Not post-quantum (TLS 1.3, no ML-KEM)	2,218	48.1%
No TLS 1.3	1,187	25.7%
Post-quantum	1,177	25.5%
Broken (a middlebox drops the PQ hello)	34	0.7%

Of the 1,177 post-quantum origins, 1,038 also pick ML-KEM when the client’s first key share is classical (pq-preferred). The other 139 accept it only when it’s offered first (pq).

Why the rest aren’t post-quantum

3,439 origins answered TLS but weren’t post-quantum.

Cause	Hosts	Share	The fix	In the fix lab?
no-mlkem	2,108	61.3%	Upgrade the TLS library, or add X25519MLKEM768 to the groups	Yes
tls12-only	1,146	33.3%	Enable TLS 1.3 and the PQ group	Yes
pinned-nist	109	3.2%	Put X25519MLKEM768 at the front of the hand-set list	Yes
no-tls	41	1.2%	—	—
large-hello-dropped	32	0.9%	Update or bypass the middlebox	Yes
pq-group-rejected	2	0.1%	Update or bypass the middlebox or TLS library	Yes
kyber-draft-only	1	0.0%	Move to final ML-KEM	Unit tests only

Three causes are 97.8% of the problem, and all three are configuration or library versions: no ML-KEM in the TLS library, no TLS 1.3, or a hand-written curve list.

If every no-mlkem, tls12-only and pinned-nist origin applied the fix pqdoctor prints, 4,540 of 4,616 would be post-quantum: 98.4%. Every fixable cause together gives 99.1%. That’s an upper bound.

Server software

From the HTTP Server header of the non-post-quantum origins:

Software	Hosts
unknown (missing or generic header)	1,639
nginx	949
apache	374
aws	333
iis	44
envoy	32
netlify	29
dotnet	21
cloudflare	9
litespeed	6
caddy	3

By cause:

Cause	Top stacks
no-mlkem	unknown 1,030, nginx 600, apache 225, aws 151, envoy 30
tls12-only	unknown 491, nginx 315, aws 177, apache 134, iis 23
pinned-nist	unknown 83, nginx 9, iis 7, aws 5, apache 4
no-tls	unknown 24, apache 9, cloudflare 4, nginx 3, iis 1
large-hello-dropped	nginx 21, unknown 9, apache 2

By rank

Tranco rank	Origins that answered	Post-quantum
1–1,000	469	30.1%
1,001–2,500	668	24.9%
2,501–5,000	1,192	24.6%
5,001–10,000	2,287	25.2%

PQ is higher only in the top 1,000. From there to rank 10,000 it’s flat at about a quarter, so this isn’t simply a head-of-list artefact.

The TLS 1.2 apexes

Many tls12-only hosts are bare domains, not the site people visit. For the TLS 1.2 apexes among the first 300 origins, the study also probed the www. names: 51 hosts, same settings.

www. result	Hosts
On a CDN (Akamai 13, CloudFront 6, Cloudflare 3)	22
tls12-only	22
no-mlkem	4
connect failed	1
no DNS	1
pq-preferred	1

So 22 of 51 TLS 1.2 apexes are a leftover origin, usually a redirect server, in front of a site that’s on a CDN. That host still terminates TLS for everyone who types the bare domain. It’s a real gap and a cheap one to fix, but it means the headline percentage partly measures redirectors.

Against other published numbers

These measure different populations, so they bracket this result rather than contradict it.

Population	PQ key exchange	Source
Origins Cloudflare connects to	12.8% (2026-09-08); “just about 15%” (2026-09-29)	Cloudflare blog
Top 1M sites	54%	F5 Labs, 2026-09-22
Top 1M sites, Cloudflare-hosted removed	22%	F5 Labs, 2026-09-22
Tranco top 10k origins not on 4 CDNs	25.5%	This study, 2026-10-14

This sample sits a little above F5’s 22% and well above Cloudflare’s ~15%. Cloudflare’s figure counts every origin it fronts, most of them far smaller than anything in a top-10k list. Depth alone doesn’t explain the gap, since PQ is flat by rank below the top 1,000. The cause mix is the part that transfers.

Sources: Cloudflare, Automatic Key Exchange for origins · Cloudflare, Is your domain using post-quantum encryption? · F5 Labs, 2026 State of PQC on the Web.