Does my server support X25519MLKEM768?

Enter your domain. For each host we list the post-quantum groups it supports, and whether it actually picks one when a browser offers it.

What this checks

Every post-quantum group each host accepts, tested one group at a time.
Whether the host prefers post-quantum key exchange or only supports it (supported but not preferred).
Hosts still offering the obsolete Kyber draft group (X25519Kyber768Draft00).

What it can't see

Groups used on connections behind your CDN or load balancer.
Client-side support: this checks your servers, not your users' browsers.

Questions

What's the difference between supported and preferred?

A server can accept X25519MLKEM768 but still choose classical X25519 when a browser offers both. Browsers then connect without post-quantum protection. Put X25519MLKEM768 first in the server's group preference.

What about the Kyber draft group?

X25519Kyber768Draft00 was an experiment before ML-KEM was standardised. Replace it with X25519MLKEM768.