The Internet relies on the Border Gateway Protocol (BGP) to exchange routing information, a system that has historically functioned on a high degree of trust. This trust model allows for 'route hijacks,' where a network announces IP addresses it does not own, potentially redirecting global traffic. To mitigate this, the Resource Public Key Infrastructure (RPKI) was developed as a cryptographic framework. It allows the holders of IP address blocks to publish Route Origin Authorizations (ROAs), which are signed records naming the specific Autonomous Systems (ASes) authorized to announce those addresses. Network operators can then perform Route Origin Validation (ROV) to automatically reject unauthorized announcements.
Recent analysis by IPinfo reveals that 70.3% of routed prefixes are now RPKI-valid, a 30% increase over the previous year. This growth was heavily influenced by China, where the share of IPv4 addresses in valid routes jumped from 3.7% in 2025 to 83.0% in 2026. Conversely, IPv6 adoption of RPKI has accelerated even faster than IPv4, with 79% of IPv6 routed prefixes now marked as valid. Despite this rapid expansion, the system is not a complete security solution. RPKI only validates the origin of a route; it does not verify the path the data takes to reach that origin. To address this, Autonomous System Provider Authorization (ASPA) is being deployed to verify authorized upstream providers, though it currently verifies only about 3.5% of routing.
The data shows a massive jump in RPKI adoption in China, where IPv4 valid routes reached 83% in 2026.
IPv6 adoption of RPKI has accelerated even faster than IPv4, with 79% of IPv6 routed prefixes now marked as valid.
Significant security gaps remain due to 'loose' ROA configurations. Approximately 16.2% of RPKI-covered IPv4 routes allow for a forged, RPKI-valid route because the ROA permits a larger block than the one actually announced. This specific configuration was exploited in August 2026 to obtain a fraudulent TLS certificate. Furthermore, RPKI protection can be lost silently if an operator's ROA expires or is removed, as seen in cases involving SEACOM and Orange Maroc. While the Internet Society notes that RPKI-related activity accounts for less than 1% of daily BGP update volume—suggesting it does not destabilize the network—the transition toward a more validated routing infrastructure continues to face challenges regarding path integrity and consistent configuration across different service providers.
RPKI protection can be lost silently if an operator's ROA expires or is removed, as seen in cases involving SEACOM and Orange Maroc.