RPKI Now Protects 70% of Internet Routes: Global BGP Validation Surge and RFC 9319 Exposure

The Border Gateway Protocol (BGP)—the fundamental routing fabric of the global Internet—has historically operated on unauthenticated trust models vulnerable to accidental misconfigurations and malicious route hijacks. According to an exhaustive empirical study by IPinfo surveying over 1.61 million routed prefixes across public RIPE RIS and RouteViews vantage points, the proportion of globally routed prefixes backed by valid Resource Public Key Infrastructure (RPKI) certificates surged to 70.3% in late 2026, up sharply from 54.0% a year prior.

Unprecedented Growth in Cryptographic Route Origin Authorizations

RPKI enables legitimate IP address block holders to cryptographically publish Route Origin Authorizations (ROAs), explicitly specifying which Autonomous System (AS) numbers are authorized to originate their prefixes. When transit networks enforce Route Origin Validation (ROV), announcements that contradict these signed records are discarded before propagating into core routing tables.

The single largest catalyst for the 16.4 percentage point global jump was China, whose share of IPv4 addresses under valid routes skyrocketed from 3.7% in September 2025 to 83.0% in September 2026. This deployment alone accounted for roughly 60% of the entire net global address gains.

Suppression of Invalid BGP Announcements

The empirical data confirms that Route Origin Validation is functioning at scale. While valid prefixes and unsigned prefixes are visible to an average of 596 and 595 global collector routers respectively, announcements that fail RPKI validation are observed by just two vantage points. Crucially, when an unauthorized AS attempts to forge origin ownership, 71% of those invalid announcements are contained to a single vantage point, demonstrating effective upstream filtering by major transit providers.

The RFC 9319 Exposure: Loose maxLength Configurations

Despite milestone adoption metrics, the study highlights a critical operational vulnerability: 16.2% of RPKI-covered IPv4 routes maintain an open 'more-specific' window by defining loose maxLength attributes in their ROAs without announcing legitimate sub-prefixes to contest them. This architectural posture mirrors the recent Hetzner/Virtualizor incident, wherein attackers forged the origin AS within an unannounced /24 sub-allocation to obtain valid TLS certificates.

“RPKI is fulfilling its foundational design objective: invalid announcements barely propagate across the modern Internet. However, network operators must enforce strict maxLength hygiene to eradicate the remaining sub-prefix attack surface.”

For enterprise infrastructure architects and transit network engineers, these findings highlight the urgent requirement to audit ROA configurations across regional internet registries and eliminate over-broad maxLength permissions.