RPKI Route Protection Surpasses 70%: A Critical Leap for Internet Security

Internet routing security has reached a milestone. RPKI (Resource Public Key Infrastructure) now protects roughly 70% of global routes, up from just 54% a year ago. According to related discussions on Hacker News and RSS feed information, this growth represents substantive progress in the internet infrastructure's ability to defend against route hijacking.

What RPKI Is and Why It Matters

RPKI is a cryptographic framework for verifying the authenticity of internet route announcements. In traditional BGP routing, any network can claim to own a certain block of IP addresses, and routers lack a mechanism to verify whether that announcement is legitimate. This trust model has led to frequent BGP hijacking—attackers or misconfigurations can easily redirect traffic to the wrong destination.

RPKI issues "Route Origin Authorizations" (ROAs) for IP address prefixes using digital signatures, allowing routers to verify whether a route announcement comes from a legitimate address holder. The jump from 54% to 70% means that nearly two-thirds of global internet routes now have verifiable origin credentials.

BGP (Border Gateway Protocol) is the internet's "routing hub," responsible for exchanging reachability information—"which IP addresses belong to whom"—between different Autonomous Systems (ASes). It was designed for scalability and flexibility, not security, so routers by default trust the address prefixes announced by their peers and do not verify whether the announcer actually owns that address block. An attacker only needs to inject a forged announcement into a BGP session to potentially pull large volumes of traffic into their own network. Such incidents are known as BGP hijacking, and there is also the more insidious route leak—a route that should only propagate locally is mistakenly spread across the entire network. RPKI was created precisely to compensate for the flaws in BGP's native trust model.

ROA (Route Origin Authorization) is the core product of RPKI. The legitimate holder of an IP address (typically having obtained the address through a Regional Internet Registry, or RIR) can use a private key to sign an ROA, declaring that "a certain Autonomous System ASN is authorized to originate a certain IP prefix." Validating routers can then determine whether a BGP announcement has a "legitimate origin." It is important to note that ROAs only address "origin authentication" and do not verify whether the entire AS path is authentic. Therefore, they cannot defend against path manipulation attacks—such issues require mechanisms like BGPsec in conjunction.

The Driving Forces Behind the Growth

This significant growth is no accident. In recent years, several major route hijacking incidents have sounded the alarm, prompting major network operators, IXPs (Internet Exchange Points), and cloud providers to accelerate RPKI deployment.

Large content delivery networks and cloud platforms have played a key role. When these networks, which carry massive amounts of traffic, were among the first to implement RPKI validation and signing, the deployment rate across the entire ecosystem was rapidly pulled up. Regional Internet Registries (RIRs) have also continued to simplify the ROA issuance process, lowering the barrier to deployment for operators.

Regional Internet Registries (RIRs) are the organizations that manage the global allocation of IP addresses and AS numbers. There are currently five: ARIN for North America, RIPE NCC for Europe and the Middle East, APNIC for Asia-Pacific, LACNIC for Latin America, and AFRINIC for Africa. They also serve as the "trust anchors" of the RPKI system, providing ROA issuance portals for address holders within their respective regions. Since ROAs must be actively issued by address holders, the RIRs' process simplification, degree of API openness, and fee policies directly determine how easy or difficult it is for operators to deploy RPKI.

IXPs (Internet Exchange Points) are neutral platforms where multiple networks interconnect within the same physical facility and exchange traffic directly. Large IXPs often implement unified RPKI validation on their route servers, so member networks can benefit indirectly even if they do not deploy RPKI themselves. This "hub-driven" effect, combined with large-scale deployment by CDNs and cloud providers, is an important structural reason for the rapid rise in coverage.

The Challenge of the Remaining 30%

Although the 70% figure is encouraging, the remaining 30% of routes remain unverified. This portion is typically concentrated among small and medium-sized ISPs, enterprise networks, and local operators in certain regions. They may lack the technical resources to deploy RPKI, or they may have concerns about migration costs.

RPKI's effectiveness also depends on validation policy. Even if a route has been signed, if downstream networks choose a "loose mode" (only looking at signatures but not rejecting invalid routes), the protective effect will be diminished. Therefore, the 70% coverage rate must be paired with stricter validation policies to truly deliver security value.

RPKI validation results are typically divided into three categories: Valid, Invalid, and NotFound (no ROA found). Different operators can choose different handling policies. Loose mode only deprioritizes Invalid routes without dropping them, and can still be exploited by attackers; strict mode directly rejects Invalid announcements and offers the highest security, but if an ROA is misconfigured, legitimate routes may be mistakenly affected, causing large-scale outages. In 2022, Meta experienced a brief but widely impactful traffic disruption caused by an erroneous ROA, which made some operators cautious about strict mode. Therefore, increasing coverage is only the first step—tightening validation policies is the key variable that determines actual protection effectiveness.

What It Means for Ordinary Users

For the vast majority of internet users, RPKI deployment is transparent—you do not need to configure anything. But its impact is very real: the risk of traffic being misdirected or intercepted is decreasing, and industries sensitive to routing security, such as finance and e-commerce, benefit directly.

From an industry perspective, 70% is a psychological threshold. It proves that the trend of RPKI shifting from an "optional extra" to a "default practice" is now irreversible. What comes next is whether the deployment rate can continue to accelerate, and whether route validation can move from signature coverage toward stricter mandatory validation.

One-line Summary

RPKI route protection rose from 54% to 70% in one year, significantly strengthening the internet's ability to resist route hijacking.

Paragraph Summary

RPKI route protection has risen from 54% a year ago to 70% today, covering nearly two-thirds of global routes and marking an important milestone in internet routing security. RPKI uses digital signatures to issue Route Origin Authorizations (ROAs) for IP address prefixes, enabling routers to verify whether BGP route announcements come from legitimate holders and thereby defend against route hijacking. This growth is mainly due to early deployment by large CDNs, cloud providers, and IXPs, as well as the continued simplification of ROA issuance by Regional Internet Registries. The remaining 30% of uncovered routes are concentrated among small and medium-sized ISPs and enterprise networks, which face technical and cost barriers. In addition, the 70% coverage rate must be paired with stricter validation policies to truly deliver security value. Overall, RPKI is shifting from an optional extra to a default practice.