On this page
RPKI adoption is usually counted in prefixes: the share of announced routes that a ROA covers, by registry or by country, as in the RIRs' RPKI adoption reports. We counted addresses instead, and split them by the kind of network announcing them. On October 10, 65.1% of routed IPv4 had a valid ROA: 92.2% of the space hosting networks announce, and 29.3% of business networks' space.
What RPKI checks
A Route Origin Authorization (ROA) is a signed statement from an address holder that an AS may announce a prefix, up to a maximum length. Route origin validation, RFC 6811, checks each BGP announcement against the published ROAs and gives one of three answers:
- Valid: a ROA authorizes this origin AS for this prefix at this length.
- Invalid: ROAs cover the prefix, but none authorizes this origin AS (invalid origin), or none allows a prefix this specific (invalid length).
- Not found: no ROA covers the prefix, so RPKI says nothing about who may announce it.
A network that validates drops invalid routes, so an announcement from the wrong origin, whether a typo or a hijack, doesn't spread through it. Valid speaks only for the origin, though. RPKI doesn't check the path, so a hijacker who presents the right origin AS passes, as in the 33-hour hijack of a Hetzner /24 that Ipregistry traced.
65.1% of addresses, 70.6% of routes
On October 10 the global routing table, as public route collectors see it, held 1,131,924 IPv4 routes, and 70.6% of them were valid. Counting each routed address once, under the most specific route that announces it, 65.1% of 3.13 billion addresses were. IPv6 is further along: 82.4% of its 269,773 routes were valid.
1.09 billion routed IPv4 addresses have no ROA, announced by 39,104 ASes. Ten of those ASes announce 43.5% of that space, and 100 announce 70.1%.
By network type
The ASN database's type is our classification of the network each AS runs. Routed IPv4 by its origin's type:
| Origin network type | Routed IPv4 | Valid | Not found | Invalid |
|---|---|---|---|---|
| Hosting | 460,126,311 | 92.2% | 7.8% | 0.02% |
| ISP | 1,986,106,537 | 73.3% | 26.6% | 0.06% |
| Education | 203,938,804 | 44.2% | 55.5% | 0.20% |
| Business | 162,513,532 | 29.3% | 70.7% | 0.05% |
| Government | 315,067,920 | 5.1% | 94.9% | <0.01% |
| All routed IPv4 | 3,127,753,104 | 65.1% | 34.9% | 0.06% |
Counted by routes, the order holds: 80.7% of hosting networks' IPv4 routes are valid, 75.2% of ISPs', 41.6% of education networks', 40.9% of business networks' and 36.3% of government's. IPv6 is ahead in every type, from 87.8% of education networks' routes to 57.4% of government's.
US Department of Defense ASes announce 264.5 million of government's 315.1 million addresses, and none of it is valid. The space of the other 4,179 government ASes is 31.7% valid.
Who announces the unsigned space
The ten ASes announcing the most routed IPv4 with no ROA:
| AS | Network | Routed IPv4 with no ROA |
|---|---|---|
| AS749 | US Department of Defense | 222,067,200 |
| AS4766 | Korea Telecom | 46,314,484 |
| AS7018 | AT&T | 44,244,992 |
| AS721 | US Department of Defense | 29,456,896 |
| AS3356 | Lumen (Level 3) | 27,090,568 |
| AS174 | Cogent | 23,904,640 |
| AS701 | Verizon Business | 22,561,024 |
| AS4134 | China Telecom | 22,536,192 |
| AS3269 | Telecom Italia | 19,811,072 |
| AS714 | Apple | 16,919,296 |
AS749 alone announces 20.4% of the unsigned space. Abuse handling is concentrated the same way: 20 mailboxes take the abuse reports for 48.8% of routed IPv4.
By the origin AS's country, among the 19 countries announcing 20 million or more addresses, the valid share runs from 98.7% in Taiwan, 98.6% in Egypt and 95.4% in France and the Netherlands down to 51.1% in the United States, 48.7% in Italy, 38.0% in Brazil and 0.7% in South Korea. Cloudflare Radar charts ROA coverage for each country too, by prefixes and by address space.
Invalid routes don't get far
Invalid routes are rare: 1,982 IPv4 routes (0.18%) and 1,191 IPv6 routes (0.44%). They also barely spread. For each route we count the route collectors' peers that carry it:
A valid IPv4 route is carried by a median of 16 collector peers, and a route with no ROA by 16 too. An invalid-origin route is carried by a median of 2, and 17 of 1,185 reach 15 or more. An invalid-length route is carried by 1, and none of 797 reach 15. A route with no ROA is accepted about as widely as a valid one; an invalid one is dropped before it reaches most of the peers.
Using the data
Three of our databases carry the route's RPKI status:
- BGP Route: every announced prefix with its origin AS,
peer_countandrpki_status, one row per origin where several announce it (schema). - IP ASN: every routed range with its origin AS, the network's
typeand the covering route'srpki_status(schema). It's one of our Open databases, free with an account. - ASN: each AS's routes by state in
rpki_valid,rpki_invalidandrpki_not_found, beside itstype(schema). It's Open too.
To check your own space, filter BGP Route on your ASNs for anything but valid: a not_found row is a prefix to sign, and an invalid:origin or invalid:length row is a ROA to fix or an announcement to look into. To weigh an address, IP ASN gives its route's status and its network's type in the one lookup, from a local copy. An invalid:origin route is announced by an AS the holder's ROAs don't name: a hijack, or a ROA nobody updated.
How we measured
Every figure is from the routing table and RPKI data of October 10. Route figures count each announced prefix once per origin AS, as BGP Route does. Address figures count each routed IPv4 address once, under the most specific route that announces it and, where several ASes originate that prefix, the one most of the routing table sees, as IP ASN does; bogon space and reserved AS numbers are left out. Network type and country are the origin AS's, from the ASN database. A collector peer is a network that shares its routes with a public route collector. From October 3 to 10 the valid share of routed IPv4 addresses stayed between 64.9% and 65.1%.
To license BGP Route, see pricing or talk to us.
