RPKI Now Protects 70% of Global Internet Routing Prefixes
Resource Public Key Infrastructure adoption reaches 70% as routing security matures globally.
1Routing Security Milestone
The share of routed internet prefixes protected by RPKI-valid records surged from 54.0% in September 2025 to 70.3% by September 2026. This 16.4 percentage point increase represents a 30% growth in one year. This rapid adoption marks a significant shift in how networks verify the legitimacy of IP address announcements globally.
2China's Massive Adoption
A substantial portion of this global growth originated from China, where valid IPv4 routes jumped from 3.7% to 83.0% within a single year. This surge accounted for nearly 60% of the total global gain. By late 2026, China's aggressive implementation transformed it from a laggard into a primary driver of global statistics.
3Effectiveness of Validation
RPKI is successfully isolating invalid routes, which now reach only a tiny fraction of the internet. A typical valid prefix is visible to 596 vantage points, whereas an invalid route is seen by only two. Nearly half of all invalid routes fail to propagate beyond a single network point, demonstrating effective containment.
4The Measurement Trap
Counting invalid routes can create misleading statistics regarding country-level security. For instance, Spain appears to have a high 28.2% invalid prefix rate, but when weighted by actual visibility, this drops to 0.057%. Analysts must distinguish between total route counts and the actual impact on global traffic flow to avoid exaggeration.
5US Department of Defense
Concentration of unprotected address space remains high, with the United States holding nearly 60% of all non-RPKI-valid IPv4 space. Approximately one in four of these addresses belongs to the US Department of Defense. Much of this space was announced in 2021 for monitoring purposes rather than for hosting active public services.
6IPv6 Overtakes IPv4
IPv6 adoption of RPKI has accelerated, surpassing IPv4 in total coverage. Validated IPv6 prefixes rose from 56% to 79%, while IPv4 grew from 54% to 68%. This ten-point lead indicates that newer infrastructure is prioritizing security protocols more effectively than legacy IPv4 address blocks, which often face complex management hurdles.
7Limitations of Origin Validation
RPKI validates the origin of a route but cannot verify the entire path. Attackers can still forge valid routes if they stay within the permissions defined by a loose ROA. Approximately 16.2% of IPv4 routes have ROAs that are wider than the actual announced prefix, leaving significant room for potential exploitation.
8The Hetzner Incident
In August 2026, an attacker exploited a loose ROA to forge a route for a 256-address block. Because the ROA allowed smaller sub-prefixes, the malicious announcement appeared RPKI-valid. This allowed the attacker to obtain a TLS certificate and serve malicious updates, proving that RPKI is not a bulletproof defense against sophisticated hijacking.
9Operational ROA Volatility
RPKI coverage can fluctuate due to administrative errors rather than security failures. Mauritius saw its coverage drop from 94% to 69% after SEACOM lost four ROAs. Similar temporary dips occurred in Saudi Arabia and Morocco, where missing records caused statistical drops that were later corrected once the organizations restored their signing infrastructure.
10ASPA Deployment Growth
ASPA, which validates the path between networks, is seeing rapid early adoption. The number of networks publishing ASPA records grew from 131 to 3,272 between September 2025 and 2026. This growth is driven by regional registries making signing tools more accessible, allowing operators to verify upstream provider relationships and catch route leaks.
11Mid-Path Failure Analysis
Global ASPA failure rates are currently skewed by incomplete records from specific operators. Syrian Telecom accounts for roughly 21% of all mid-path ASPA failures due to missing upstream provider declarations. Because one operator can disproportionately impact global metrics, current failure rates do not yet accurately reflect the overall health of internet routing.
12Future Security Outlook
RPKI has successfully secured the majority of internet routes, rendering most invalid announcements invisible to the broader network. While gaps remain in path validation and loose ROA configurations, the focus is shifting toward better operational practices. Networks must now prioritize tightening their ROA settings to eliminate the remaining windows for potential exploitation.
Original article: Hacker News — RPKI Now Protects 70% of Global Internet Routing Prefixes