Glonce

IPinfo: 70% of routed prefixes now RPKI-valid, up from 54%

securityThe Glonce editorsHacker News🔥72Glonce rating72Impact55Novelty55Relevance85Surprise55Players20Credibility85

IPinfo analysed a year of RPKI and ASPA deployment data, September 2025 to September 2026. RPKI lets the holder of a block of IP addresses publish a signed record, a Route Origin Authorization (ROA), naming the networks allowed to announce it; operators that check can reject announcements that fail. The motivating example is the February 24, 2008 incident, when Pakistan Telecom (AS17557) tried to block YouTube inside Pakistan with a more specific route, its upstream PCCW Global (AS3491) passed it on, and YouTube traffic was redirected to Pakistan globally for roughly two hours.

The headline result: the share of routed prefixes that are RPKI-valid rose from 54.0% to 70.3%, a gain of 16.4 percentage points, or 30% in a year. In each of the two previous years it rose three to four points. Counted by IPv4 addresses on September 28 each year, the share was 42.7% in 2023, 47.9% in 2024, 53.1% in 2025 and 65.0% in 2026. The last jump was 11.9 points, against about five in earlier years.

Much of that came from China, whose share of IPv4 addresses in valid routes went from 3.7% to 83.0%, almost 60% of the global gain counted by addresses. Most of the change happened in 2026: at the end of December 2025, just 2.9% of China's routed prefixes were valid. Outside China the share rose from 58.0% to 63.2%, a 5.2-point gain, a little less than the year before. In 2025 China had pulled the global average down (53.1% worldwide against 58.0% without it); in 2026 it pushed it up (65.0% against 63.2%). Others moved far too: Egypt from 23% to 99%, Kazakhstan from 16% to 84%, Mexico from 37% to 78%, South Africa from 38% to 60%. IPv6 overtook IPv4 over the window: valid IPv6 prefixes rose from 56% to 79%, IPv4 from 54% to 68%, which contradicts early-2025 worries that IPv6 adoption was slowing (Job Snijders had written in RPKI's 2024 year in review for RIPE Labs that IPv6 ROA growth "seems to be stalling."). Two other metrics he flagged also changed: address blocks per ROA climbed back from 2.31 to 2.62, and publication points rose from 73 to 91 as more organizations host their own repositories. The unprotected space is concentrated too: of routed IPv4 space not in RPKI-valid routes on September 28, nearly 60% is in the United States, and about one in four addresses belongs to the US Department of Defense, mostly space it began announcing in 2021 to watch for misuse rather than to run services.

Is it protecting anything? The authors say yes. A typical valid prefix is seen by 596 of the routers feeding the public RIPE RIS and RouteViews collectors, a prefix with no RPKI record by 595, and an invalid one by just two. Nearly half of all invalid routes reach a single vantage point, and 71% where the wrong network announces the addresses. Internet Society Pulse found in August that RPKI-related activity is under 1% of daily BGP update volume, so RPKI is not itself destabilizing routing.

That changes how country statistics read. Spain has the highest share of invalid IPv4 prefixes at 28.2%, but if the addresses in those routes are weighted by how many vantage points see each one, the figure falls to 0.057%. Slovakia drops from 17.4% to almost zero. Italy has the highest weighted figure of any country with at least a million IPv4 addresses, 0.121% (up from 0.075%), and 90% of it is one network. WIND TRE (AS1267) announces 34 routes its own ROAs don't allow: 19 more specific than permitted, and 15 from AS1267 where the ROA names its other network, AS24608. None reaches more than 77 vantage points, against about 617 for the signed blocks around them.

RPKI is not bulletproof, because it validates who may originate a prefix, not the path. On August 28, 2026, a route for 162.55.80.0/24 (256 addresses) appeared with Hetzner's AS24940 forged as origin. Hetzner's ROA covered the surrounding /16 and allowed announcements as small as a /24, so the forged route was RPKI-valid, had no legitimate /24 competing, and won on longest-prefix match. It was enough to get a genuine TLS certificate and serve a malicious Virtualizor update to hypervisors, as documented by Kentik. In the authors' words, nothing about RPKI failed; the ROA permitted it. IPinfo measured how common this posture is: of 855,217 RPKI-covered IPv4 routes, 138,698 (16.2%) have a ROA looser than the announced route and no more-specific route filling the gap; for IPv6 it is 20.9%. That leaves roughly 18 million more-specific prefixes an attacker could announce with a forged origin and still come out valid and uncontested. Providers differ widely: Contabo has an open window on 540 of 553 covered routes, DigitalOcean on 780 of 863, OVH sits at 11.5%; among access providers Cablevision is at 98.1%, Shaw 96.5%, Bharti Airtel 85.0%. RFC 9319 says best practice is to leave maxLength unset, so a ROA matches only the block actually announced. Hetzner tightened three prefixes after the incident, including the hijacked one, but 49 of its 63 covered routes remain open.

Coverage can also vanish silently. Mauritius fell from 94.0% to 69.0% of IPv4 addresses in valid routes after SEACOM (AS37100) lost four of its six ROAs on January 1; one covered 105.16.0.0/12, about a million addresses, 46% of them in Mauritius, and it still had no ROA on September 28. Saudi Telecom (AS25019) lost protection on 19 routes, including six large blocks totaling about 1.6 million addresses, when ROAs disappeared between March 30 and April 13; they came back on September 21 and 22. In Morocco, Orange Maroc (AS36925) is the only large operator that publishes ROAs, and most went missing twice, from July 2025 to July 2026 and again from July 25 to September 3, so coverage went from 20% to almost none and back. A measurement trap: some validation methods count a record as failed when a stale link to its parent certificate appears after a repository move, even though routes stay RPKI-valid. IPinfo found thousands of such records present in every independently validated set it checked, so a count of failing records is not a measure of lost protection.

Finally, ASPA, which has networks publish signed lists of authorized upstream providers so observed AS paths can be checked and route leaks caught. On September 28, 2025, 131 networks had published ASPA records; a year later there were 3,272, 25 times as many. Growth came in steps that follow registries making signing available (RIPE NCC from about 85 networks to 470 by end of December, ARIN from January 21, APNIC at the end of June and again in September), so the authors call tooling the main driver. On September 28, 2026, 9.7% of observed routing passed ASPA checks, up from 6.2%, but paths through only one or two networks always pass under the draft rules and were about 6% of routing in both years. Excluding them, published records verify about 3.5% of routing, up from roughly 0.1%. Almost all the rest is unknown rather than failing. Paths breaking ASPA rules mid-path rose from effectively zero to 0.048% of observations, which the authors say is not necessarily routing getting worse: as publication grew, previously unjudgeable paths became testable and some failed. They add that attribution needs care, since one provider with a stale record makes all its customers' routes look invalid.

Key facts

  • The share of routed prefixes that are RPKI-valid rose from 54.0% in September 2025 to 70.3% in September 2026, a gain of 16.4 percentage points, versus three to four points in each of the two previous years.
  • China went from 3.7% to 83.0% of its IPv4 addresses in valid routes, almost 60% of the global gain counted by addresses; outside China the address-level share rose from 58.0% to 63.2%.
  • Invalid routes are seen by about two vantage points, against 596 for valid prefixes and 595 for prefixes with no RPKI record, which IPinfo takes as evidence that RPKI filtering works.
  • Loose ROAs remain a gap: 16.2% of 855,217 covered IPv4 routes (20.9% for IPv6) leave room for roughly 18 million forged-origin more-specific prefixes, as in the August 28, 2026 Hetzner AS24940 incident.
  • ASPA publishers grew from 131 to 3,272 networks in a year, but published records verify only about 3.5% of observed routing once automatically passing short paths are excluded.

Why it matters

BGP routing has historically depended on trust, and RPKI is the main defence against a network announcing addresses it should not, the failure behind the 2008 YouTube outage. This is a measured jump of 16.4 points in a single year, against three to four points a year before, and the data suggests the checks bite: invalid routes reach about two vantage points while valid and unsigned ones reach about 596 and 595. The article also shows where the picture is weaker than the headline: one country drives much of the gain, ROAs are often too loose, and ASPA, which covers path validation, can check only a small slice of routing.

Who it affects

Network operators and address holders who publish ROAs, especially hosting and access providers with loose ROAs (Contabo, DigitalOcean, Cablevision, Shaw and Bharti Airtel are named with high shares of open windows, OVH and Hetzner as contrasts or partial fixes). It also touches operators in countries whose coverage swung: China, Egypt, Kazakhstan, Mexico, South Africa, and Mauritius, Saudi Arabia and Morocco where ROAs were lost. Anyone who reads or cites country-level RPKI statistics is affected by the measurement caveats, and so are customers of services whose address space could be hijacked with a forged origin.

How to use it

The article is analysis rather than a tool, but it points to concrete practice. Address holders can follow RFC 9319 and leave maxLength unset so a ROA matches only the block actually announced, as Hetzner partly did after its incident. Because a missing ROA removes protection without an outage, coverage is worth monitoring, as the SEACOM, Saudi Telecom and Orange Maroc cases show. When reading country statistics, weigh invalid routes by how many vantage points see them rather than counting them, and check whether a source counted failing records or the validated list routers actually use. For ASPA, publishing a record naming your authorized upstream providers is what grows the checkable share.

How solid is it

The figures are IPinfo's own measurements, taken from public RIPE RIS and RouteViews collector data, over a window ending September 28, 2026; they are not official registry statistics. The prefix-level and address-level numbers differ (70.3% of routed prefixes against 65.0% of IPv4 addresses) and the article keeps them separate. The authors flag their own measurement trap: counts of failing records can overstate lost protection, and they say this applies to their numbers too. The Hetzner incident is attributed to Kentik's documentation. The claim that RPKI is working rests on vantage-point visibility, which is a proxy for filtering rather than a direct count of rejected routes.

Risks and caveats

RPKI validates who may originate a prefix, not the path, so an attacker who stays inside a published ROA can still succeed; the forged Hetzner route was valid for exactly that reason. Loose ROAs are common: 16.2% of covered IPv4 routes and 20.9% of IPv6 leave an open window. Coverage can disappear silently, and about 60% of unprotected IPv4 space is in the United States, roughly a quarter of it belonging to the US Department of Defense. ASPA is early: 9.7% of observed routing passes, mostly automatically, and the 0.048% of mid-path failures should not be read as routing getting worse. China's jump is large and the article gives no explanation for it, so the global trend outside China (58.0% to 63.2% by addresses) is the steadier signal.

“Nothing about RPKI failed. The ROA permitted it.”

— IPinfo blog, on the forged-origin route for 162.55.80.0/24