Loading…

RPKI routing security

The Resource Public Key Infrastructure (RPKI) lets address holders publish signed ROAs stating which Autonomous System may originate each prefix in BGP. Networks doing Route Origin Validation then classify every announcement as:

Valid — a ROA exists and the announcing AS matches it. Safe to accept.
Invalid — a ROA exists but the origin or prefix length is wrong. Often a hijack or misconfiguration; should be dropped.
Not found — no ROA covers the prefix, so it cannot be verified either way.

Higher valid share means a network is harder to hijack via a bogus BGP announcement. Coverage below is weighted by address count within each family.

IPv4 RPKI coverage

51.2%

2.2B of 4.3B routed addrs valid

IPv6 RPKI coverage

51.4%

8.2B of 15.9B routed /48 valid

Invalid prefixes

4,561

4,204 IPv4 · 357 IPv6 — potential hijacks

Unverifiable

48.7%

of routed IPv4 has no ROA (not found)

Validation status by family

Share of routed address space that is RPKI valid, invalid, or not found — by address weight.

Best IPv4 coverage

Countries with the highest valid share (routed IPv4 ≥ 10M addresses).

Country	Coverage	Routed IPv4	Invalid
NL Netherlands	93.1%	60.8M	24
DK Denmark	92.4%	11.5M	0
CZ Czechia	91.8%	11.3M	5
Germany

Lowest coverage among large holders

Most-exposed networks — large routed footprint (≥ 10M addrs) but little RPKI signing.

Country	Coverage	Routed IPv4	Invalid
TN Tunisia	0.0%	18.5M	0
KR South Korea	0.4%	160.6M	1
MA Morocco	0.9%	30.5M	0
MX Mexico	11.1%	37.4M	17
BR Brazil	16.7%	114.8M	35
VN Vietnam	18.8%	44.1M	7
CO Colombia	32.1%	21.8M	196
ZA South Africa	33.0%	38.7M	26
EG Egypt	36.7%	55.4M	0
AR Argentina	42.1%	33.7M	17
MY Malaysia	45.6%	14.5M	35
US United States	45.9%	1.7B	1.6K
IT Italy	46.3%	65.2M	21
CA Canada	47.8%	79.8M	42
TW Taiwan	48.0%	55.9M	106