Who's running all those tiny RPKI servers?
blog.apnic.net
July 15, 2026
15 min read
🔥🔥🔥🔥🔥
47/100
Summary
Border Gateway Protocol (BGP) is vulnerable to prefix hijacks due to a lack of built-in trust. Resource Public Key Infrastructure (RPKI) allows address space holders to cryptographically authorize which Autonomous Systems (AS) can originate their prefixes through Route Origin Authorizations (ROAs), establishing a chain of trust with five Regional Internet Registries (RIRs).
Key Takeaways
- Resource Public Key Infrastructure (RPKI) allows address space holders to cryptographically authorize which Autonomous Systems (AS) may originate their prefixes, enhancing trust in BGP routing.
- Most Route Origin Authorizations (ROAs) are published by the five Regional Internet Registries (RIRs), but a significant number are also published by smaller, independently operated servers.
- A server is classified as 'small' if it announces fewer than 1,300 ROA objects, distinguishing them from larger providers like the RIRs and AWS.
- Smaller RPKI servers are operated for various legitimate reasons, despite the availability of publication services from RIRs.
