More than 70% of the internet's routed address blocks now carry a valid cryptographic signature, up from 54% in September 2025. China drove the jump: its share of IPv4 addresses in valid routes rose from 3.7% to 83% in a year.
Filtering now bites: an invalid route reaches about two vantage points, against roughly 596 for a valid one. The next layer, path validation, is spreading, with four of five regional internet registries accepting provider-authorization (ASPA) records. A hole remains: 16.2% of signed IPv4 routes have a record loose enough for a forged announcement to pass.
Why it matters
Route hijacks have caused major outages for years; at 70% coverage, most forged routes now get stopped at the network edge.
Questions about this story
Free account needed to ask — your question is kept and asked for you right after sign-up. Answers are public.
No questions yet — be the first to ask.
Key Indicators
70.3%
Routed prefixes with valid RPKI signatures
Up from 54.0% in September 2025; data pulled September 28, 2026.
92%
China's RPKI signing rate, per CNNIC
CNNIC says the rate rose from under 5% a year earlier; this counts published records, not validated routes.
83%
China's IPv4 addresses in RPKI-valid routes
Up from 3.7% a year earlier; roughly 60% of the global gain.
65%
Global IPv4 addresses in RPKI-valid routes
Up from 53.1% in September 2025; IPv6 prefixes are about ten points ahead.
3,272
Networks publishing ASPA path-validation records
Up from 131 a year earlier; ASPA catches route leaks that origin validation misses.
15 events
Latest: October 23rd, 2026 · 3 weeks ago
Showing 8 of 15
JK to step
Tap a bar to jump to that date
Jump to
October 2026
ARIN: 9,673 RPKI registrations, about 1,195 without a route record
LatestMeasurement
Registrations rose 27% in a year, but roughly one in seven hosted RPKI organizations has published no Route Origin Authorization. ARIN also counted 3,389 ASPA records across the registries and previewed a BGP Insight tool.
APNIC reports 538 ASPA objects and warns of misconfiguration
Guidance
APNIC says 538 provider-authorization objects are published under its trust anchor and warns that a misconfigured record can invalidate every route involving a customer's network.
First Global RPKI Report logs registry outages
Report
Job Snijders announced a quarterly report on the RPKI repository system on the NANOG mailing list. It records AFRINIC letting a certificate revocation list expire on September 20, which invalidated subordinate products, and error responses from RIPE NCC's Bangalore server in August and September.
IPinfo publishes the report behind the coverage figure
Report
Analysis documents a typical invalid route reaching about two vantage points, against roughly 596 for a valid route, plus the remaining loose-ROA gap.
CNNIC reports China's RPKI signing rate above 92%
Measurement
CNNIC says China's signing rate rose from under 5% a year earlier, and it has started an ASPA pilot for path validation with partners. A China Mobile speaker noted that validation rates remain low.
RScope study maps holes in upstream ROV protection
Research
The ACM Internet Measurement Conference paper reports 1,815 ASes rely on upstream validation, and 69.6% of those remain vulnerable to local hijacks. It also measures a 37-minute lag between ROA updates and router enforcement.
Saudi Arabia tops RPKI route validation at 99.8%
Measurement
Saudi Gazette, citing APNIC figures, reports Saudi networks lead the world in activating RPKI route origin validation at 99.8%.
September 2026
LACNIC adds ASPA publishing to its member portal
Launch
Members can create, preview and publish provider-authorization records in MiLACNIC, and LACNIC's FORT validator can check them. Four of the five registries now support ASPA through their portals.
70.3% of routed prefixes RPKI-valid, up 16.4 points
Measurement
China reaches 83% of IPv4 addresses; Egypt, Kazakhstan, Mexico, and South Africa also jump sharply.
Global RPKI passes one million signed route records
Milestone
The distributed repository crossed 1,000,000 ROA payloads. About 5.8 million new objects moved through the system in September alone.
August 2026
Forged Hetzner route passes validation via loose ROA
Incident
A 256-address route with a forged origin was accepted because Hetzner's ROA allowed smaller announcements.
December 2025
China had 2.9% of routed prefixes valid
Data point
End-of-year snapshot showed China's deployment still barely started.
September 2025
54% of routed prefixes RPKI-valid; China at 3.7%
Measurement
Annual data pull; global growth was modest and China dragged the average down.
May 2024
APNIC reports over 50% of IPv4 routes carry valid ROAs
Milestone
Geoff Huston notes more than half of routes are signed and 70.3% of traffic is valid.
September 2023
IPinfo baseline: 42.7% of IPv4 addresses in valid routes
Measurement
Annual data pull shows the starting point before the deployment surge.
Scenarios
1
RPKI valid coverage passes 80% of routed prefixes by September 2027
Possible
Resolves by Sep 28, 2027
Discussed by: IPinfo and Hurricane Electric trackers; APNIC analyses
The easy gains are done — China went from 3.7% to 83% in a year. Getting another ten points requires India, Brazil, Russia, and Indonesia, which remain partial. If any of these large economies mounts a deployment push like China's, the target is reachable.
2
First RPKI-valid hijack exploits a loose ROA
Possible
Resolves by End of 2027
Discussed by: IPinfo analysis of the August 2026 Hetzner incident
16.2% of covered IPv4 routes have a ROA looser than the announced route, leaving about 18 million more-specific prefixes attackable. An attacker can announce a more-specific block within a valid ROA, forge the origin, and pass validation uncontested. The August Hetzner case showed this is already happening at small scale.
3
ASPA path validation becomes the next routing-security race
Likely
Resolves by Sep 28, 2027
Discussed by: IPinfo; RIPE Labs; Internet Society Pulse
ASPA (Autonomous System Provider Authorization) lets a network publish signed records of its authorized upstream providers, catching route leaks that origin validation misses. Deployment grew 25-fold in a year, from 131 networks to 3,272. If the trend holds, path validation becomes the industry's next adoption wave.
4
Upstream protection leaves most 'protected' networks hijackable
Likely
Resolves by Q3 2027
Discussed by: RScope researchers at the ACM Internet Measurement Conference
Many networks never deploy their own validation and rely on a transit provider to filter for them. RScope found 69.6% of those protected ASes can still be hijacked locally, and router enforcement trails ROA changes by about 37 minutes. Wider ROV deployment by the networks themselves would have to close that gap.
5
China turns on RPKI validation to match its signing rate
Possible
Resolves by Sep 28, 2027
Discussed by: CNNIC and China Mobile at the routing security forum
China signed most of its address space in a year, but CNNIC says relatively few Chinese networks filter invalid routes, leaving them exposed. China Mobile has argued RPKI only pays off when signing and validation are both in place. A validation push would cut a large share of the remaining attack surface.
6
A registry outage silently invalidates routes that were signed and valid
Possible
Discussed by: Job Snijders' Global RPKI Report; RPKIViews collectors
The RPKI is a live database, and it fails. On September 20, 2026 AFRINIC did not re-sign and distribute a certificate revocation list before the old one expired, invalidating all subordinate products, and RIPE NCC's Bangalore repository answered delta requests with HTTP 503 errors across parts of August and September. As more routes depend on the system, a repository outage can turn announcements that were valid into invalid ones at the relying party.
Historical Context
3 moments from history that rhyme with this story — and how they unfolded.
1 of 3
July 2010
DNSSEC root signing (2010)
The Internet's root zone was cryptographically signed, allowing resolvers to verify DNS records end-to-end. DNSSEC had been specified since the late 1990s, and the signing took years of coordination.
Then
The infrastructure was in place, but barely any zones were signed.
Now
A decade later, only a small fraction of domains use DNSSEC, with notable failures like the 2024 incident that broke signed domains. It showed that cryptographic infrastructure adoption needs ecosystem pressure, not just standards.
Why this matters now
Like DNSSEC, RPKI is a cryptographic layer added to existing internet protocols, and its adoption curve was similarly slow — until the 2026 surge.
2 of 3
April 2016
Let's Encrypt and the HTTPS tipping point (2016)
Let's Encrypt launched free, automated TLS certificates. Within two years it had issued over 100 million certificates, and encrypted HTTPS traffic surpassed half of all page loads on major browsers.
Then
Encryption went from optional to default across most of the web.
Now
It made unencrypted HTTP the exception, not the rule, within a few years.
Why this matters now
The RPKI surge shows a similar dynamic: once tooling and free signing made adoption cheap, a single large actor (China) flipped the global average.
3 of 3
June 2012
World IPv6 Launch (2012)
Major operators permanently enabled IPv6 on their networks, marking the protocol's transition from testing to production.
Then
IPv6 traffic grew steadily but stayed a small fraction for years.
Now
A decade later IPv6 still hasn't fully replaced IPv4, showing how long global protocol transitions take.
Why this matters now
RPKI adoption is now ahead of the IPv6 curve — and unlike IPv6, it doesn't require replacing addressing, just adding signatures to it.
