RPKI Now Protects 70% of Global Internet Routing
Resource Public Key Infrastructure adoption reaches major milestone, securing internet traffic against malicious hijacking.
1The Evolution of Routing
The internet relies on Border Gateway Protocol to direct traffic between networks. Historically, these announcements depended on trust, leading to incidents like the 2008 Pakistan Telecom YouTube hijack. RPKI was developed to replace this implicit trust with cryptographic verification, allowing address holders to sign records that authorize specific networks to announce their IP prefixes.
2Rapid Adoption Growth
The share of RPKI-valid routed prefixes increased from 54.0% in September 2025 to 70.3% in September 2026. This 16.4 percentage point gain represents a 30% annual growth rate. Much of this surge is attributed to China, which moved from 3.7% to 83.0% validity, significantly shifting the global average for IPv4 address space.
3Effectiveness of Validation
RPKI is successfully limiting the reach of invalid routes. A typical valid prefix is seen by 596 vantage points, while an invalid route is seen by only two. Nearly half of all invalid routes reach just a single vantage point, proving that network operators are increasingly rejecting announcements that fail cryptographic verification checks.
4Refining Statistical Accuracy
Counting invalid routes can exaggerate the impact of routing errors. For instance, Spain has the highest share of invalid IPv4 prefixes at 28.2%, but when weighted by vantage point visibility, this figure drops to 0.057%. Italy currently holds the highest weighted figure at 0.121%, with 90% of that impact originating from one specific network.
5IPv6 Leads Adoption
Contrary to concerns from early 2025, IPv6 adoption of RPKI has accelerated and now surpasses IPv4. Routed prefixes marked valid for IPv6 rose from 56% to 79%, while IPv4 reached 68%. This puts IPv6 roughly ten points ahead, demonstrating a clear shift in security priorities for newer internet address space deployments and infrastructure.
6The Limits of Origin
RPKI validates the origin of a route but cannot verify the entire path. Attackers can still forge valid routes if they stay within the permissions defined by a loose ROA. For example, a Hetzner-forged route was RPKI-valid because the ROA allowed smaller blocks than necessary, enabling a malicious update to be served to hypervisors.
7Addressing Loose Configurations
Approximately 16.2% of RPKI-covered IPv4 routes have ROAs that are looser than the actual announced route. Best practices, such as RFC 9319, suggest leaving the maxLength setting unset to prevent this vulnerability. While some providers have tightened their configurations, many hosting and access providers still maintain broad permissions that could be exploited by attackers.
8Transient Protection Gaps
RPKI coverage can disappear without causing immediate outages, leading to silent protection gaps. Mauritius saw its coverage fall from 94% to 69% after SEACOM lost four ROAs. Similarly, Saudi Telecom and Orange Maroc experienced temporary drops in coverage due to missing records, highlighting the need for continuous monitoring of signed routing data.
9Validation Measurement Traps
Some methods incorrectly flag records as failed when they are still providing protection. If an operator moves their repository, links to certificates may go stale, triggering a false failure report. However, routers walk down from trust anchors, meaning these routes remain valid in practice. Distinguishing between record failures and actual protection loss is critical.
10Emergence of ASPA
ASPA, or Autonomous System Provider Authorization, addresses path validation by naming authorized upstream providers. Deployment has grown rapidly, from 131 networks in 2025 to 3,272 by September 2026. This growth is driven by registries making signing tools available, allowing networks to catch route leaks that origin validation alone cannot detect or prevent.
11ASPA Deployment Challenges
Currently, 9.7% of observed routing passes ASPA checks. Most failures are not indicative of poor health but rather incomplete records. Syrian Telecom accounts for 21% of all mid-path ASPA failures due to incomplete provider declarations. As more networks publish accurate records, the ability to judge path validity will improve, reducing the current unknown status.
12Future Security Outlook
RPKI now protects the majority of internet routes, and invalid traffic is effectively contained. Remaining vulnerabilities are largely in the hands of address holders who must tighten ROA configurations and adopt ASPA. While not bulletproof, the current ecosystem provides a robust foundation for securing global routing against accidental and deliberate traffic redirection.