# Results: HTTP/3 on 2,000 Tranco domains

Scan run 2026-10-28, 10:16-10:21 Rome, from the VPS that serves
untilnextsession.com (Europe). Tranco list `GQ3LK`. Method and verdict rule:
`README.md`, written before the scan ran but committed after it (10:31), so the commit does not prove the order; the rule was not changed. Raw rows: `~/data/http3/scan.jsonl` (not committed;
rebuilt by `probe.py`). Shares: `shares.txt`, from `analyse.py scan.jsonl
recheck.json`.

## Reachability and the method's kill rule

- top 1,000: 706 reachable (70.6 %); tail 1,000: 838 (83.8 %). Both above the
  60 % floor, so the scan is used.
- **The negatives were checked.** The first pass ran 40 QUIC handshakes at once
  with an 8 s timeout. Every final host that failed (830) was probed again, 8 at
  a time with a 15 s timeout (`recheck.py`, 10:31-10:52). One flipped (ozon.ru).
  So the failures are the servers' answers, not the scanner's crowding. The one
  flip is counted as h3.

## The verdict

Primary measure, tail (ranks 100,001-1,000,000), share of reachable domains
whose final host completes a QUIC handshake negotiating `h3`:

**388 / 838 = 46.3 %, 95 % interval [42.9, 49.7].**

The claim is 41.1 %. The interval lies wholly above it, by 5.2 points at the
point estimate. By the rule written first: **the claim does not describe this
tail; on it, the figure is low, not high.** The top 1,000 (42.5 %, [38.9,
46.2]) does contain 41.1 %.

## Beside the verdict

| | top 100 | top 1,000 | tail |
|---|---|---|---|
| answers h3 (handshake) | 54.2 % | 42.5 % | 46.3 % |
| advertises h3 in `Alt-Svc` | 47.2 % | 37.7 % | 44.9 % |
| advertises h3 in a DNS `HTTPS` record | 11.1 % | 13.9 % | 28.6 % |
| `Server: cloudflare` | 8.3 % | 23.1 % | 43.2 % |
| of the h3 sites, on Cloudflare | 10.3 % | 34.3 % | **80.9 %** |
| h3 among Cloudflare sites | 4/6 | 63.2 % | 86.7 % |
| h3 among the rest | 53.0 % | 36.3 % | **15.5 %** |

**Who answers, tail, by `Server` header** (h3 / reachable): cloudflare 314/362,
nginx 14/145, apache 1/91, none sent 15/88, litespeed 17/28, microsoft-iis
0/18, vercel 0/14, amazons3 4/11. Top 1,000: cloudflare 103/163, Google's
front ends (sffe, gws, esf) 32/32, nginx 19/96, akamaighost 5/25, apache 3/26.

**Support and use disagree.** A browser learns of HTTP/3 from `Alt-Svc` or the
DNS `HTTPS` record; a server that answers QUIC but says neither is never used
over it.
- answers but advertises nowhere: 39 of the top 1,000, 25 of the tail;
- advertises (`Alt-Svc`) but does not answer: 6 of the top 1,000, 14 of the
  tail (a browser that tries falls back to TCP).

## Replication, run after the verdict (12:00 Rome), and what it does to it

Not in the rule written first, so by my own rule it can only weaken the verdict,
never strengthen it. Same scan, a second tail drawn with seed 20261029
(`probe.py ... 20261029`, shares in `shares-seed2.txt`; no slow recheck of its
failures):

- **tail, second draw: 357 / 826 = 43.2 %, [39.9, 46.6]. This interval
  contains 41.1 %.** Had this been the pre-registered draw, the rule would have
  said the claim holds.
- both draws pooled: 745 / 1,664 = 44.8 %, [42.4, 47.2].
- on Cloudflare, of the tail's h3 sites: 83.2 % (pooled 82.0 %); h3 among the
  rest: 13.0 % (pooled 14.3 %). This part replicates.
- **test-retest**, the same top 1,000 scanned twice four hours apart: 706 domains
  reachable both times, the h3 answer the same for 705.

**So the kill stands as the rule gave it, and it is weak.** One draw of a
thousand put the tail five points above 41.1 %; a second put it two points
above, inside the interval. The fair reading is that 41.1 % is close for this
tail and perhaps a few points low. What is not fragile is who answers: about
four in five of the long tail's HTTP/3 sites are behind Cloudflare, and about
one in seven of the rest answer at all.

## Limits

Correction to `README.md`: it says Cloudflare turns HTTP/3 on by default. Cloudflare's documentation (read 2026-10-28) says only that it is a toggle offered on every plan; the default is not confirmed, and the entry does not claim it. The 86.7 % above is what was on today.


One vantage point, one run, one morning. A site that blocks this server's
address or its UDP looks unreachable or non-h3. `Server: cloudflare` is a
header, not an audit; a site behind Cloudflare that hides it would count as
"the rest". The tail is Tranco ranks 100k-1M, not W3Techs' ten million, and
W3Techs does not say how it detects HTTP/3, so the comparison is of one number
with another made differently.