Pull to refresh
Logo
Daily Brief
Following Why Sign Up
RPKI route protection reaches most of the internet, up from half a year ago

RPKI route protection reaches most of the internet, up from half a year ago

New Capabilities

Valid cryptographic signatures now cover 70% of routed prefixes, 16 points more than in September 2025

October 2026: IPinfo publishes the report behind the coverage figure

Overview

Updated Yesterday

A year ago, a forged internet route announced by the wrong network could travel the globe. Today, most such routes stop almost immediately at the network edge. More than 70% of routed address blocks now carry a valid RPKI signature — Resource Public Key Infrastructure — up from 54% in September 2025.

The jump of 16.4 percentage points is roughly four times the annual gain in each of the two prior years. Nearly 60% of the global increase, counted by IPv4 addresses, came from one country: China went from 3.7% of its addresses in valid routes to 83%.

RPKI lets the holder of an IP address block publish a signed record naming the networks allowed to announce it. Networks that check those records reject mismatched announcements. Invalid routes now reach just two of the 596 routers feeding public routing collectors, while valid routes reach nearly all of them. The remaining gaps — and a next step called path validation — are where the security story continues.

Why it matters

Route hijacks have caused major outages for years; at 70% coverage, most forged routes now get stopped at the network edge.

Questions about this story

Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.

No questions yet — be the first to ask.

Key Indicators

70.3%
Routed prefixes with valid RPKI signatures
Up from 54.0% in September 2025; data pulled September 28, 2026.
83%
China's IPv4 addresses in RPKI-valid routes
Up from 3.7% a year earlier; roughly 60% of the global gain.
65%
Global IPv4 addresses in RPKI-valid routes
Up from 53.1% in September 2025; IPv6 prefixes are about ten points ahead.
3,272
Networks publishing ASPA path-validation records
Up from 131 a year earlier; ASPA catches route leaks that origin validation misses.

Voices

Curated perspectives — historical figures and your fellow readers.

Ever wondered what historical figures would say about today's headlines?

Sign up to generate historical perspectives on this story.

Log in Sign Up

People Involved

JS
Job Snijders
RIPE Labs researcher and RPKI advocate
Publishes annual RPKI industry reviews
 Geoff Huston
Geoff Huston
Chief Scientist, APNIC
Analyzes RPKI deployment and routing stability at APNIC

Organizations Involved

IPinfo
IPinfo
Data and intelligence provider
Published the September 2026 measurement report

IP data and measurement company that tracks RPKI validation across the global routing table.
Internet Society
Internet Society
Nonprofit standards and policy organization
Runs MANRS routing-security framework; tracks RPKI impact

Global nonprofit that promotes an open internet and runs the MANRS (Mutually Agreed Norms for Routing Security) program.
Hurricane Electric
Hurricane Electric
Network operator
Publishes widely-cited RPKI adoption report

Large global network operator whose RPKI report is a standard reference for deployment levels.

Timeline

September 2023 October 2026

7 events Latest: October 2026
Tap a bar to jump to that date

  1. IPinfo publishes the report behind the coverage figure

    Latest Report

    Analysis documents invalid routes reaching just two of 596 vantage points and the remaining loose-ROA gap.

  2. 70.3% of routed prefixes RPKI-valid, up 16.4 points

    Measurement

    China reaches 83% of IPv4 addresses; Egypt, Kazakhstan, Mexico, and South Africa also jump sharply.

  3. Forged Hetzner route passes validation via loose ROA

    Incident

    A 256-address route with a forged origin was accepted because Hetzner's ROA allowed smaller announcements.

  4. China had 2.9% of routed prefixes valid

    Data point

    End-of-year snapshot showed China's deployment still barely started.

  5. 54% of routed prefixes RPKI-valid; China at 3.7%

    Measurement

    Annual data pull; global growth was modest and China dragged the average down.

  6. APNIC reports over 50% of IPv4 routes carry valid ROAs

    Milestone

    Geoff Huston notes more than half of routes are signed and 70.3% of traffic is valid.

  7. IPinfo baseline: 42.7% of IPv4 addresses in valid routes

    Measurement

    Annual data pull shows the starting point before the deployment surge.

Scenarios

1

RPKI valid coverage passes 80% of routed prefixes by September 2027

Possible Resolves by Sep 28, 2027

Discussed by: IPinfo and Hurricane Electric trackers; APNIC analyses

The easy gains are done — China went from 3.7% to 83% in a year. Getting another ten points requires India, Brazil, Russia, and Indonesia, which remain partial. If any of these large economies mounts a deployment push like China's, the target is reachable.

2

First RPKI-valid hijack exploits a loose ROA

Possible Resolves by End of 2027

Discussed by: IPinfo analysis of the August 2026 Hetzner incident

16.2% of covered IPv4 routes have a ROA looser than the announced route, leaving about 18 million more-specific prefixes attackable. An attacker can announce a more-specific block within a valid ROA, forge the origin, and pass validation uncontested. The August Hetzner case showed this is already happening at small scale.

3

ASPA path validation becomes the next routing-security race

Likely Resolves by Sep 28, 2027

Discussed by: IPinfo; RIPE Labs; Internet Society Pulse

ASPA (Autonomous System Provider Authorization) lets a network publish signed records of its authorized upstream providers, catching route leaks that origin validation misses. Deployment grew 25-fold in a year, from 131 networks to 3,272. If the trend holds, path validation becomes the industry's next adoption wave.

Historical Context

3 moments from history that rhyme with this story — and how they unfolded.

July 2010

DNSSEC root signing (2010)

The Internet's root zone was cryptographically signed, allowing resolvers to verify DNS records end-to-end. DNSSEC had been specified since the late 1990s, and the signing took years of coordination.

Then

The infrastructure was in place, but barely any zones were signed.

Now

A decade later, only a small fraction of domains use DNSSEC, with notable failures like the 2024 incident that broke signed domains. It showed that cryptographic infrastructure adoption needs ecosystem pressure, not just standards.

Why this matters now

Like DNSSEC, RPKI is a cryptographic layer added to existing internet protocols, and its adoption curve was similarly slow — until the 2026 surge.

April 2016

Let's Encrypt and the HTTPS tipping point (2016)

Let's Encrypt launched free, automated TLS certificates. Within two years it had issued over 100 million certificates, and encrypted HTTPS traffic surpassed half of all page loads on major browsers.

Then

Encryption went from optional to default across most of the web.

Now

It made unencrypted HTTP the exception, not the rule, within a few years.

Why this matters now

The RPKI surge shows a similar dynamic: once tooling and free signing made adoption cheap, a single large actor (China) flipped the global average.

June 2012

World IPv6 Launch (2012)

Major operators permanently enabled IPv6 on their networks, marking the protocol's transition from testing to production.

Then

IPv6 traffic grew steadily but stayed a small fraction for years.

Now

A decade later IPv6 still hasn't fully replaced IPv4, showing how long global protocol transitions take.

Why this matters now

RPKI adoption is now ahead of the IPv6 curve — and unlike IPv6, it doesn't require replacing addressing, just adding signatures to it.

Sources

(6)
+1
IPinfo APNIC Blog everyWAN Communications of the ACM Proceedings of the 2026 ACM Internet Measurement Conference APNIC Blog