Routing security hit a number that has been a decade in the making. IPinfo measured the internet on September 28 and found 70.3 percent of routed IPv4 prefixes are now RPKI-valid, up from 54.0 percent a year earlier. Previous years moved 3 to 4 points annually. This year moved 16.4.
The fine print on that jump
Before anyone credits a global awakening, look at where the movement came from. China’s share of IPv4 addresses in valid routes went from 3.7 percent to 83.0 percent, which accounts for almost 60 percent of the global gain. Strip China out and the rest of the world improved from 58.0 to 63.2 percent, a thoroughly unremarkable 5.2 points in line with prior years. Other countries did jump on their own steam: Egypt reached 99 percent, Kazakhstan 84, Mexico 78, and South Africa 60.
The milestone also holds up against independent measurement. The MANRS Observatory puts valid ROA coverage at about 70.5 percent of announced address space, so this is not one dataset’s quirk.
Does RPKI actually work?
The propagation numbers are the most persuasive thing in the report. A typical valid prefix is visible at 596 of the BGP vantage points feeding RIPE RIS and RouteViews. A prefix with no RPKI record: 595. An RPKI-invalid prefix: two. Nearly half of invalid routes reach a single vantage point, and when the wrong network originates the addresses, 71 percent of those routes reach only one. Filtering invalids has become the default at enough transit networks that forged-origin routes now die quietly on the wire instead of propagating.
The mechanism is not destabilizing the routing system to do it either. Internet Society Pulse found RPKI-related activity accounts for under 1 percent of daily BGP update volume as of August.
The attack moved, and RPKI did not follow
Here is the part that should temper the celebration. On August 28, a route for 162.55.80.0/24 appeared announcing Hetzner’s AS24940 as origin. The problem: Hetzner’s ROA for the surrounding /16 allowed /24 maxLength, so the forged route was RPKI-valid by construction. No filter rejected it, and no alarm fired from origin validation. The hijack, analyzed by Kentik as an attack on hosting software vendor Virtualizor, diverted traffic at peak to about 72 percent of RIPE RIS collector peers and ran for roughly a day and a half.
The payoff for the attacker was a genuine Let’s Encrypt TLS certificate for 26 product domains, because the CA’s domain validation ran over the hijacked path. That certificate then made malicious Virtualizor update deliveries look legitimate in the browser. Everything a victim checks worked, because the routing layer lied and the TLS layer believed it.
RFC 9319 has said for years that ROAs should leave maxLength unset so they cover only the block actually announced. The measurement says most operators have not absorbed that: 16.2 percent of RPKI-covered IPv4 routes, about 138,700 of 855,000, have a looser ROA than the announced route, leaving roughly 18 million more-specific prefixes an attacker could announce with a forged origin and still pass validation. Hetzner tightened three prefixes after the incident; 49 of its 63 covered routes remain open.
What the remaining 30 percent looks like
The unprotected third is not evenly spread. Nearly 60 percent of it sits in the United States, and about a quarter of that is Department of Defense space announced since 2021 partly to watch for misuse, which is a deliberate sinkhole rather than a fixable gap. The genuine laggards are the long tail: tens of thousands of stub ASes and small regional ISPs running route origin validation in monitor-only mode or not at all. One IETF gap analysis cited in the report found only 12.3 percent of ASes fully protected end to end.
Coverage also regresses silently. Mauritius fell from 94.0 to 69.0 percent valid after SEACOM lost four of six ROAs on January 1, one of them covering a million addresses. Saudi Telecom lost ROAs on about 1.6 million addresses, and Orange Maroc lost most of its ROAs twice. Nothing breaks when a ROA disappears; protection just quietly switches off.
What to do with this
- Publish ROAs for every prefix you announce. Three in ten routed prefixes still have none.
- Leave maxLength unset so a ROA matches exactly what you announce. One in six covered routes currently has an open window, and the Hetzner incident is what that window looks like when someone walks through it.
- Monitor that your ROAs remain published. Silent loss is the failure mode nobody pages on.
- If you run transit or a large network, move ROV filtering from monitor-only to enforcement for invalids. The propagation data shows the herd already does this; laggards provide the residual cover for hijackers.
- Sign your software releases. The Virtualizor incident is also a supply chain story: DNS plus TLS over a hijacked path was enough to deliver malicious updates.
The next layer is already forming. ASPA, which validates the path rather than just the origin, grew from 131 to 3,272 publishing networks in a year, though it covers about 3.5 percent of observed routing. RPKI closed the door on the lazy hijack. The Hetzner case shows what the patient ones do next, and maxLength hygiene is the cheapest door to close while the path-validation tools mature.