Overview
Browsers and the big edge networks already use hybrid post-quantum key exchange for most traffic. The weak point is the second hop: the connection from the edge to the origin server a company runs itself. Published figures for that hop disagreed (Cloudflare reported about 13–15% of the origins it connects to; F5 Labs reported 22% of the top 1M once Cloudflare-hosted sites were removed), and none said why the rest were not post-quantum. This study measures it directly and answers the why.
Every origin was probed with pqdoctor, which reads only the server's first reply and never completes a handshake. The scan carried a contact address in its user agent and honoured an opt-out list. Results and method are published on pqdoctor.com.
Methods
- - Tranco list N26LW (top 10k + 1M)
- - CDN filtering from published ranges
- - Hand-built TLS 1.3 ClientHellos
- - Server fingerprinting via HelloRetryRequest
- - Stratified sampling, 95% intervals
- - Zipf traffic weighting
- - Node.js report pipeline
The post-quantum share by Tranco rank, for every origin and for self-run servers only
Why the 3,327 non-post-quantum origins in the top 10k are not, one level down
Year
2026
Type
Internet Measurement
Role
Independent Researcher
Scale
10,000+ origins
Findings
28.1% of top-10k origins are post-quantum (1,298 of the 4,625 that answered TLS), up from 25.5% in the first run ten days earlier. Weighted by traffic, it is 61.3%: the most popular origins are far more often post-quantum than the tail.
Self-run servers get less post-quantum further down the list: about 27.6% in the top 1,000, settling near 20% from rank 10,000 to 1,000,000. The raw share rises anyway, because the deeper you go the more sites sit on hosting platforms and hidden Cloudflare edges, which are almost all post-quantum already.
The rest is mostly old libraries and provider products, not configuration. Only 0.4% of non-post-quantum origins need just a config change. 34.2% run a TLS library that cannot do ML-KEM (OpenSSL 3.0–3.4, end-of-life OpenSSL 1.1.1, Go before 1.24) and 16.4% sit behind a provider product with a post-quantum setting to switch on.
Top 10k
Probed in full
10k – 1M
4 × 2,500 sample
Method
Finding the origins: each name was resolved and dropped if its address fell inside Cloudflare's, Fastly's or CloudFront's published ranges, or inside prefixes announced by Akamai's CDN networks (Akamai publishes no edge list, so these came from routing data). That left 5,141 origins in the top 10k, of which 4,625 answered TLS.
Going deeper without being dominated by the tail: below rank 10,000, 2,500 names were drawn from each of four bands (10k–30k, 30k–100k, 100k–300k, 300k–1M) with a fixed seed, so the curve is measured evenly in log-rank. Each band reports a 95% interval, and the combined figure weights each band by the ranks it covers.
One level below the verdict: to say why a server is not post-quantum, pqdoctor sends six single-group TLS 1.3 hellos with no key share and reads which groups the server asks to retry with. That group profile, combined with the Server header, identifies the TLS library or provider product, so each origin is classed as config, library, provider, or unknown.
Checking the tool: verdicts were cross-checked against OpenSSL on a sample (91 of 93 agreed), and the fixes pqdoctor prints were shown to work on a lab of deliberately misconfigured servers.
Plan
50 fixes → 69%
What It Means
Most non-post-quantum origins cannot be fixed with one config line, so a scanner that only reports a verdict leaves operators stuck. That finding shaped pqdoctor 0.3: it names the class of problem, prints the change that fits it, and offers a sidecar (cloudflared or Caddy) for servers whose library cannot be upgraded yet.
It also changed how to prioritise. Using the same traffic weighting, a greedy planner with a provable bound picks which origins to fix first: fixing just 50 well-chosen origins in the top 10k would raise the traffic-weighted share from 61.3% to 69.0%, within 0.1% of the best possible choice.
Between the two runs, 132 origins became post-quantum and 15 stopped being post-quantum, which is why the tooling built on this study tracks regressions, not only progress.