Cloudflare now shows post-quantum encryption use for each domain

Cloudflare introduced post-quantum encryption visibility at the domain level on September 29, 2026. How much of a domain's traffic is protected with post-quantum encryption can now be seen in the HTTP Traffic Analytics dashboard, Log Explorer and Logpush logs.

New fields in dashboards and logs

The feature shows which key exchange algorithm is negotiated on each TLS 1.3 connection. The post-quantum option is X25519MLKEM768, a hybrid method that combines classical X25519 with ML-KEM; the connection stays secure as long as either of the two holds. Classical X25519, P-256 and P-384, along with the deprecated draft X25519Kyber768Draft00, are listed separately. HTTP Traffic Analytics has a dedicated card for TLS key exchange groups, and traffic can be filtered by this field. For individual connections, the ClientTLSKeyExchangeGroup field, which covers the visitor-to-Cloudflare connection, has been added to the TLS category of the HTTP Requests dataset. For the Cloudflare-to-origin connection, Logpush offers the OriginTLSKeyExchangeGroup field.

This visibility helps companies that want to see whether their own servers are ready for post-quantum encryption. Protection against attacks that collect data today to decrypt it once powerful quantum computers arrive matters most for those handling data that must stay secret for years, such as the public sector, finance, healthcare and telecom. Citing Radar data, Cloudflare says most traffic on the browser side is already ready, while most origin servers do not yet use the method.

If the share turns out low

According to the company, if a domain shows no X25519MLKEM768 at all, the first step is to confirm that TLS 1.3 is enabled. There is no separate post-quantum setting; with TLS 1.3 on, Cloudflare uses it automatically with visitors that support it. If most traffic arrives with classical algorithms, many visitors may be non-browser clients. For legacy origin servers that do not support post-quantum encryption, Cloudflare suggests placing the server behind Cloudflare Tunnel without upgrading it, so traffic from the server to Cloudflare travels over X25519MLKEM768.

The announcement does not mention plan limits; according to Cloudflare's documentation, Logpush is available only on the Enterprise plan, and access to Log Explorer is worth checking in your account dashboard. The visibility covers encryption for now; post-quantum authentication for certificates and signatures is to be added as that technology spreads. When weighing migration plans, it is worth following evaluations from independent security researchers.

Sources: Cloudflare: Post-quantum visibility, Cloudflare Docs: Logpush.