The Internet relies on networks telling each other which IP addresses they can deliver traffic to, using BGP (Border Gateway Protocol). These routing announcements have historically depended heavily on trust. When a network announces addresses it shouldn’t, accidentally or deliberately, traffic can be sent to the wrong place and services can become unreachable.
On February 24, 2008, Pakistan Telecom (AS17557) tried to block YouTube inside Pakistan by announcing a more specific route for YouTube’s addresses. Its upstream provider, PCCW Global (AS3491), accepted the announcement and passed it to the rest of the Internet, redirecting YouTube traffic to Pakistan globally for roughly two hours (RIPE NCC’s case study). That’s exactly the kind of error RPKI is designed to prevent. Work on RPKI had started at the IETF two years earlier, and the regional Internet registries began issuing RPKI certificates in 2011.
RPKI (Resource Public Key Infrastructure) lets the holder of a block of IP addresses publish a signed record, a Route Origin Authorization (ROA), naming the networks (Autonomous Systems, or ASes) allowed to announce it. Network operators that check RPKI compare announcements against those records and can reject the ones that fail.
The share of routed prefixes (blocks of IP addresses) that are RPKI-valid rose from 54.0% in September 2025 to 70.3% in September 2026, a gain of 16.4 percentage points, or 30% in a year. That’s a sharp increase. In each of the two years before, it rose three to four points. Much of the jump came from one country: China went from 3.7% of its IPv4 addresses in valid routes to 83.0%, almost 60% of the global gain counted by addresses.
RPKI grew more in the past year than in the two years before it combined: 16.4 points, against 3.9 and 3.2. Data pulled on September 28 of each year.
RPKI is doing what it was designed to do. A typical valid prefix is seen by 596 of the routers that feed the public RIPE RIS and RouteViews collectors. One with no RPKI record is seen by 595, and an invalid one by just two.
Invalid Routes Barely Propagate
In August, the Internet Society Pulse found RPKI-related activity accounts for under 1% of daily BGP update volume, a share that is rising but still small, so RPKI is not itself destabilizing routing. We wanted to know whether RPKI was actually protecting Internet routing.
Number of BGP vantage points (peers of the RIPE RIS and RouteViews collectors) seeing each prefix, by RPKI status. September 28, 2026, across 1,614,288 routed prefixes.
Routes with an RPKI record and routes with none travel equally far: a typical one is seen by 596 and 595 vantage points. Routes that fail the check are seen by just two. Now that enough networks check, they are dropping these invalid routes. Nearly half of all invalid routes reach only a single vantage point. When the wrong network announces the addresses, the clearest kind of hijack or mistake, 71% reach only one.
Simply counting invalid routes can badly exaggerate how much of a country is affected. Spain has the highest share of invalid IPv4 prefixes at 28.2%. Count the addresses in those routes instead, weighted by how many vantage points see each one, and it falls to 0.057%.
Counted by IPv4 addresses on September 28 each year, the share in RPKI-valid routes rose from 42.7% in 2023 to 65.0% in 2026. China’s share of IPv4 addresses in valid routes went from 3.7% in September 2025 to 83.0% a year later.
In early 2025 there were concerns that IPv6 adoption of RPKI was slowing. Instead, it accelerated and has now overtaken IPv4: IPv6 routed prefixes marked valid rose from 56% to 79% while IPv4 prefixes rose from 54% to 68%.
RPKI validates who may originate a prefix. It does not validate the path. On August 28, 2026, a route for 162.55.80.0/24 appeared with Hetzner’s AS24940 forged as the origin while the ROA permitted it; attackers obtained a genuine TLS certificate and served a malicious Virtualizor update (Kentik). Of 855,217 RPKI-covered IPv4 routes, 138,698 (16.2%) have a ROA looser than the route announced.
ASPA (Autonomous System Provider Authorization) addresses path validation. On September 28, 2025, 131 networks had published ASPA records; by September 28, 2026 there were 3,272. On September 28, 2026, 9.7% of observed routing passed ASPA checks, up from 6.2% a year earlier.
Operators are advised to publish ROAs for all announced prefixes, leave maxLength unset, verify ROAs remain published, and publish complete ASPA provider lists.
IPinfo tracks the RPKI status of every routed prefix daily: ipinfo.io/data/rpki.
Methodology: All figures come from IPinfo’s routing and RPKI datasets, one RPKI snapshot per day. RPKI validity is the share of routed prefixes classified valid against the validated authorization set. Routing data comes from the public RIPE RIS and RouteViews collectors.