RPKI now protects 70% of internet routes

RPKI, the system that lets IP-address holders authorize which networks may announce their routes through BGP, classified 70.3% of routed Internet prefixes as valid on September 28, 2026, up from 54.0% a year earlier. Networks checking RPKI can reject unauthorized route origins, limiting mistakes and hijacks such as Pakistan Telecom’s 2008 YouTube rerouting incident. China drove much of the increase, moving from 3.7% to 83.0% of its IPv4 addresses in valid routes; Egypt, Kazakhstan and Mexico also made large gains. A typical valid route reached 596 public routing-data vantage points, while an invalid route reached only two. RPKI does not protect against all route hijacks. A forged route for a Hetzner address block passed RPKI validation on August 28, 2026 because Hetzner’s authorization permitted more-specific routes, enabling an attacker to obtain a TLS certificate and distribute a malicious Virtualizor update. IPinfo found that 16.2% of 855,217 RPKI-covered IPv4 routes had similarly permissive authorizations. ASPA, a newer mechanism for authorizing upstream providers and checking BGP paths, expanded from 131 publishing networks in September 2025 to 3,272 a year later. Only 3.5% of routing with paths longer than two networks could be positively verified by ASPA, while incomplete records at Syrian Telecom accounted for about one-quarter of observed mid-path ASPA failures.