RPKI Now Protects 70% of Internet Routes, Up From 54% a Year Ago

The Internet relies on networks telling each other which IP addresses they can deliver traffic to, using BGP (Border Gateway Protocol). These routing announcements have historically depended heavily on trust. When a network announces addresses it shouldn’t, accidentally or deliberately, traffic can be sent to the wrong place and services can become unreachable.On February 24, 2008, Pakistan Telecom (AS17557) tried to block YouTube inside Pakistan by announcing a more specific route for YouTube's addresses. Its upstream provider, PCCW Global (AS3491), accepted the announcement and passed it to the rest of the Internet, redirecting YouTube traffic to Pakistan globally for roughly two hours (RIPE NCC's case study). That’s exactly the kind of error RPKI is designed to prevent. Work on RPKI had started at the IETF two years earlier, and the regional Internet registries began issuing RPKI certificates in 2011.RPKI (Resource Public Key Infrastructure) lets the holder of a block of IP addresses publish a signed record, a Route Origin Authorization (ROA), naming the networks (Autonomous Systems, or ASes) allowed to announce it. Network operators that check RPKI compare announcements against those records and can reject the ones that fail.The share of routed prefixes (blocks of IP addresses) that are RPKI-valid rose from 54.0% in September 2025 to 70.3% in September 2026, a gain of 16.4 percentage points, or 30% in a year. That’s a sharp increase. In each of the two years before, it rose three to four points. Much of the jump came from one country: China went from 3.7% of its IPv4 addresses in valid routes to 83.0%, almost 60% of the global gain counted by addresses.RPKI grew more in the past year than in the two years before it combined: 16.4 points, against 3.9 and 3.2. Data pulled on September 28 of each year.RPKI is doing what it was designed to do. A typical valid prefix is seen by 596 of the routers that feed the public RIPE RIS and RouteViews collectors. One with no RPKI record is seen by 595, and an invalid one by just two. Invalid Routes Barely PropagateIn August, the Internet Society Pulse found RPKI-related activity accounts for under 1% of daily BGP update volume, a share that is rising but still small, so RPKI is not itself destabilizing routing. We wanted to know whether RPKI was actually protecting Internet routing.Number of BGP vantage points (peers of the RIPE RIS and RouteViews collectors) seeing each prefix, by RPKI status. September 28, 2026, across 1,614,288 routed prefixes.Routes with an RPKI record and routes with none travel equally far: a typical one is seen by 596 and 595 vantage points. Routes that fail the check are seen by just two. Now that enough networks check, they are dropping these invalid routes. Nearly half of all invalid routes reach only a single vantage point. When the wrong network announces the addresses, the clearest kind of hijack or mistake, 71% reach only one.This changes how country-level RPKI statistics should be read. A country can look bad because of announcements almost nobody sees.Simply counting invalid routes can badly exaggerate how much of a country is affected. Spain has the highest share of invalid IPv4 prefixes at 28.2%. Count the addresses in those routes instead, weighted by how many vantage points see each one, and it falls to 0.057%. Slovakia falls from 17.4% to almost zero. Italy has the highest figure of any country with at least a million IPv4 addresses, 0.121%, up from 0.075% a year ago, and 90% of it is one network. WIND TRE (AS1267) announces 34 routes in its own address space that its own ROAs don't allow: 19 are more specific than the ROAs permit, and 15 come from AS1267 while the ROA names WIND TRE's other network, AS24608. None reaches more than 77 vantage points, against about 617 for the signed blocks around them.Gray: share of a country's routed IPv4 prefixes that are RPKI-invalid. Blue: share of its IPv4 addresses in invalid routes, weighted by how many vantage points see each route. The 12 countries with the highest gray share and at least a million IPv4 addresses, September 28, 2026. The number after each country is its rank by gray share.China Drove Most of the 2026 JumpCounted by IPv4 addresses on September 28 each year, the share in RPKI-valid routes rose from 42.7% in 2023 to 47.9% in 2024, 53.1% in 2025 and 65.0% in 2026. The last jump was 11.9 points, against about five in each previous year.Removing China shows how much of that was one country. Outside China, the share rose from 58.0% to 63.2%, a 5.2-point gain, a little less than the year before.China's own change was extraordinary. 3.7% of its IPv4 addresses were in valid routes in September 2025, and 83.0% a year later. Most of that happened this year: at the end of December 2025, just 2.9% of China's routed prefixes were valid. It also changed which way it moves the world figure. In 2025 China pulled the global average down: 53.1% worldwide against 58.0% without China. In 2026 it pushed it up: 65.0% against 63.2%. Others moved a long way too: Egypt from 23% to 99%, Kazakhstan from 16% to 84%, Mexico from 37% to 78%, and South Africa from 38% to 60%.Share of IPv4 addresses in RPKI-valid routes, September 28 of each year. Outside China the share rose about five points in each of the last two years. The lines cross in 2026, when China moved from lowering the global figure to raising it.Share of each country's IPv4 addresses in RPKI-valid routes, September 28, 2026. Gray means no data.Where the unprotected addresses are is just as concentrated. Of all routed IPv4 space not in RPKI-valid routes on September 28, nearly 60% is in the United States, and about one in four addresses belongs to the US Department of Defense (more on who holds IPv4 in an upcoming post). Most of that is space the Department began announcing in 2021 to watch for misuse, not to run services.IPv6 Has Moved AheadIn early 2025 there were concerns that IPv6 adoption of RPKI was slowing. Instead, it accelerated and has now overtaken IPv4. In RPKI's 2024 year in review for RIPE Labs, Job Snijders noted IPv6 ROA growth "seems to be stalling." Over our window, IPv6 routed prefixes marked valid rose from 56% to 79% while IPv4 prefixes rose from 54% to 68%, putting IPv6 roughly ten points ahead. The Hurricane Electric RPKI report shows the same ordering.Two other metrics he flagged also changed: the average number of address blocks per ROA climbed back from 2.31 at the end of December to 2.62, and publication points, which he counted falling from 63 to 53 and read as consolidation, rose from 73 to 91 as more organizations began hosting their own repositories instead of relying on their registry.Share of routed prefixes marked RPKI-valid, by address family. Daily, September 28, 2025 to September 28, 2026.What RPKI Does Not DoRPKI validates who may originate a prefix.