RPKI Now Protects 70% of Global Internet Routing
Resource Public Key Infrastructure adoption reaches a critical milestone in securing BGP routing integrity.
1Routing Security Milestone
The global share of RPKI-valid routed prefixes reached 70.3% in September 2026, marking a significant 30% increase from 54.0% the previous year. This growth represents a sharp acceleration compared to the three to four percentage point gains observed in each of the two preceding years, signaling widespread adoption of routing security protocols.
2The China Factor
China drove a substantial portion of this global increase, with its IPv4 address validity jumping from 3.7% to 83.0% within one year. This shift was so dramatic that it moved the global average from a downward trend in 2025 to an upward trajectory in 2026, accounting for nearly 60% of global gains.
3Validation Effectiveness
RPKI is successfully limiting the reach of invalid routes. While a typical valid prefix is visible to 596 vantage points, invalid routes reach only two. Nearly half of all invalid routes now reach only a single vantage point, demonstrating that network operators are increasingly rejecting unauthorized announcements that fail RPKI validation checks.
4Statistical Measurement Traps
Counting invalid routes can exaggerate impact, as many reach almost no one. For instance, Spain has the highest share of invalid IPv4 prefixes at 28.2%, but when weighted by vantage point visibility, this figure drops to 0.057%. Analysts must distinguish between total invalid routes and those actually affecting global traffic flow.
5IPv6 Adoption Leads
IPv6 adoption of RPKI has surpassed IPv4, reaching 79% validity compared to 68% for IPv4. This trend reverses earlier concerns from 2024 that IPv6 implementation was stalling. The growth is supported by an increase in publication points, as more organizations now host their own repositories rather than relying solely on regional registries.
6The Limits of RPKI
RPKI validates the origin of a route but does not verify the path, leaving it vulnerable to attackers who stay within published permissions. A recent incident involving Hetzner demonstrated that if a ROA is configured too loosely, an attacker can forge an origin that remains technically RPKI-valid, bypassing security protections entirely.
7Risks of Loose Configuration
Approximately 16.2% of RPKI-covered IPv4 routes and 20.9% of IPv6 routes have ROAs looser than the actual announced route. This configuration gap allows attackers to announce more-specific prefixes that appear valid. Best practices now dictate leaving the maxLength setting unset to ensure ROAs match only the specific blocks actually being announced.
8Operational Maintenance Challenges
RPKI coverage can disappear due to missing ROAs, as seen with Mauritius, where the share of valid addresses dropped from 94% to 69% after SEACOM lost four ROAs. Similar temporary drops occurred in Saudi Arabia and Morocco, highlighting the need for consistent operational maintenance to ensure that security records remain active.
9Validation Method Nuances
Some validation methods incorrectly flag records as failed due to stale repository links, even when the routes remain valid in practice. Routers do not follow these stale links; they walk down from trust anchors. Therefore, a count of failing records is not a reliable measure of lost protection or routing instability.
10ASPA Deployment Progress
ASPA, which validates the path between networks, is seeing rapid early adoption. The number of networks publishing ASPA records grew from 131 to 3,272 between September 2025 and 2026. This growth is largely driven by registries making signing tools available, with each registry release triggering a measurable jump in network participation.
11Interpreting ASPA Failures
Mid-path ASPA failures are currently dominated by incomplete records from specific operators rather than systemic routing health issues. For example, Syrian Telecom accounts for 21% of all global mid-path failures due to incomplete provider declarations. Consequently, current ASPA failure rates do not yet serve as an accurate metric for global internet health.
12Future Security Outlook
RPKI now protects the majority of internet routes, and invalid announcements are effectively contained. While gaps remain, particularly in US Department of Defense address space and loose ROA configurations, the industry is moving toward more granular path validation. Future security depends on operators maintaining accurate records and tightening their ROA configurations.
Original article: Hacker News: Front Page — RPKI Now Protects 70% of Global Internet Routing