RPKI passes 60% of IPv4 routes: what a signed origin protects, and what it can’t
A quiet security milestone: most announced IPv4 routes now carry a valid signed origin. What that stops, what it can't, and why the rest is slow.
BGP runs on trust: any network can announce any prefix, and historically the internet just… believed it. Fat-fingered announcements have taken banks offline; malicious ones have detoured traffic through unfriendly networks. RPKI (Resource Public Key Infrastructure) is the fix the industry settled on: prefix owners publish signed statements (ROAs) declaring which autonomous system may originate their routes.
In 2026 the measurement crossed a symbolic line: NIST’s RPKI Monitor counts more than 60% of announced IPv4 routes as RPKI-valid. And (the part that matters) a growing number of large transit networks now drop announcements that fail validation instead of merely flagging them.
Why 60% is a big number
Security infrastructure suffers from a bootstrapping problem: nobody benefits until enough others deploy it. For years only a small minority of routes were covered, and origin validation was dismissed as academic. The tipping came when the biggest carriers and cloud providers started rejecting invalid routes outright: suddenly an unsigned prefix meant degraded reachability, and signing became self-interest rather than good citizenship.
The rest is a long tail of older enterprises and networks where the registry paperwork is genuinely painful. And RPKI only validates the origin: a determined attacker can still forge the path. That is what BGPsec and ASPA are for, and why this story will have sequels.
Why this matters if you’re learning networking: If you can explain what a ROA protects against (and what it cannot) you understand BGP better than most working engineers. This is exactly the kind of context interviewers probe for after the textbook answer.
Keep reading
Related
-
The physical internet: how submarine cables carry your packets
Your packets cross oceans on glass. A look at where the new cables land, who pays for them, and what happens when an anchor wins.
-
Wi-Fi 7 Multi-Link Operation (MLO): what it changes for your home lab
MLO is the headline feature of Wi-Fi 7. What actually changes for latency and for your packet captures, and what is still marketing or waiting for Wi-Fi 8.
-
IPv6 passes half of Google’s users: what the milestone does and doesn’t mean
In March 2026, for the first time, more than half of the users reaching Google arrived over IPv6. Why that majority and the website majority still point in opposite directions.
