# RPKI adoption by network type: hosting 92%, business 29%

65.1% of routed IPv4 has a valid ROA. By the network announcing it: hosting 92.2%, ISPs 73.3%, education 44.2%, business 29.3%, government 5.1%.

RPKI adoption is usually counted in prefixes: the share of announced routes that a ROA covers, by registry or by country, as in the [RIRs' RPKI adoption reports](https://nro.net/?p=31123). We counted addresses instead, and split them by the kind of network announcing them. On October 10, 65.1% of routed IPv4 had a valid ROA: 92.2% of the space hosting networks announce, and 29.3% of business networks' space.

## What RPKI checks

A Route Origin Authorization (ROA) is a signed statement from an address holder that an AS may announce a prefix, up to a maximum length. Route origin validation, [RFC 6811](https://www.rfc-editor.org/rfc/rfc6811), checks each BGP announcement against the published ROAs and gives one of three answers:

- **Valid**: a ROA authorizes this origin AS for this prefix at this length.
- **Invalid**: ROAs cover the prefix, but none authorizes this origin AS (invalid origin), or none allows a prefix this specific (invalid length).
- **Not found**: no ROA covers the prefix, so RPKI says nothing about who may announce it.

A network that validates drops invalid routes, so an announcement from the wrong origin, whether a typo or a hijack, doesn't spread through it. Valid speaks only for the origin, though. RPKI doesn't check the path, so a hijacker who presents the right origin AS passes, as in the 33-hour hijack of a Hetzner /24 that [Ipregistry traced](https://ipregistry.co/blog/virtualizor-hetzner-bgp-hijack-rpki-valid).

## 65.1% of addresses, 70.6% of routes

On October 10 the global routing table, as public route collectors see it, held 1,131,924 IPv4 routes, and 70.6% of them were valid. Counting each routed address once, under the most specific route that announces it, 65.1% of 3.13 billion addresses were. IPv6 is further along: 82.4% of its 269,773 routes were valid.

1.09 billion routed IPv4 addresses have no ROA, announced by 39,104 ASes. Ten of those ASes announce 43.5% of that space, and 100 announce 70.1%.

## By network type

The [ASN](https://internetdata.io/databases/asn) database's `type` is our classification of the network each AS runs. Routed IPv4 by its origin's type:

| Origin network type | Routed IPv4 | Valid | Not found | Invalid |
|---|---|---|---|---|
| Hosting | 460,126,311 | 92.2% | 7.8% | 0.02% |
| ISP | 1,986,106,537 | 73.3% | 26.6% | 0.06% |
| Education | 203,938,804 | 44.2% | 55.5% | 0.20% |
| Business | 162,513,532 | 29.3% | 70.7% | 0.05% |
| Government | 315,067,920 | 5.1% | 94.9% | <0.01% |
| All routed IPv4 | 3,127,753,104 | 65.1% | 34.9% | 0.06% |

Counted by routes, the order holds: 80.7% of hosting networks' IPv4 routes are valid, 75.2% of ISPs', 41.6% of education networks', 40.9% of business networks' and 36.3% of government's. IPv6 is ahead in every type, from 87.8% of education networks' routes to 57.4% of government's.

US Department of Defense ASes announce 264.5 million of government's 315.1 million addresses, and none of it is valid. The space of the other 4,179 government ASes is 31.7% valid.

## Who announces the unsigned space

The ten ASes announcing the most routed IPv4 with no ROA:

| AS | Network | Routed IPv4 with no ROA |
|---|---|---|
| AS749 | US Department of Defense | 222,067,200 |
| AS4766 | Korea Telecom | 46,314,484 |
| AS7018 | AT&T | 44,244,992 |
| AS721 | US Department of Defense | 29,456,896 |
| AS3356 | Lumen (Level 3) | 27,090,568 |
| AS174 | Cogent | 23,904,640 |
| AS701 | Verizon Business | 22,561,024 |
| AS4134 | China Telecom | 22,536,192 |
| AS3269 | Telecom Italia | 19,811,072 |
| AS714 | Apple | 16,919,296 |

AS749 alone announces 20.4% of the unsigned space. Abuse handling is concentrated the same way: [20 mailboxes take the abuse reports for 48.8% of routed IPv4](https://internetdata.io/blog/ip-abuse-contact).

By the origin AS's country, among the 19 countries announcing 20 million or more addresses, the valid share runs from 98.7% in Taiwan, 98.6% in Egypt and 95.4% in France and the Netherlands down to 51.1% in the United States, 48.7% in Italy, 38.0% in Brazil and 0.7% in South Korea. [Cloudflare Radar](https://radar.cloudflare.com/routing/rpki/kr) charts ROA coverage for each country too, by prefixes and by address space.

## Invalid routes don't get far

Invalid routes are rare: 1,982 IPv4 routes (0.18%) and 1,191 IPv6 routes (0.44%). They also barely spread. For each route we count the route collectors' peers that carry it:

![Stacked bar chart of IPv4 routes on 2026-10-10 by RPKI status and how many collector peers carry them: 93.8% of valid routes and 95.0% of routes with no ROA reach 15 or more peers, while 96.0% of invalid-origin and 98.7% of invalid-length routes reach 3 or fewer.](/blog/media/rpki-route-peers.2x.png)

A valid IPv4 route is carried by a median of 16 collector peers, and a route with no ROA by 16 too. An invalid-origin route is carried by a median of 2, and 17 of 1,185 reach 15 or more. An invalid-length route is carried by 1, and none of 797 reach 15. A route with no ROA is accepted about as widely as a valid one; an invalid one is dropped before it reaches most of the peers.

## Using the data

Three of our databases carry the route's RPKI status:

- [BGP Route](https://internetdata.io/databases/bgp-route): every announced prefix with its origin AS, `peer_count` and `rpki_status`, one row per origin where several announce it ([schema](https://docs.internetdata.io/database/bgp-route)).
- [IP ASN](https://internetdata.io/databases/ip-asn): every routed range with its origin AS, the network's `type` and the covering route's `rpki_status` ([schema](https://docs.internetdata.io/database/ip-asn)). It's one of our Open databases, free with an account.
- [ASN](https://internetdata.io/databases/asn): each AS's routes by state in `rpki_valid`, `rpki_invalid` and `rpki_not_found`, beside its `type` ([schema](https://docs.internetdata.io/database/asn)). It's Open too.

To check your own space, filter BGP Route on your ASNs for anything but `valid`: a `not_found` row is a prefix to sign, and an `invalid:origin` or `invalid:length` row is a ROA to fix or an announcement to look into. To weigh an address, IP ASN gives its route's status and its network's type in the one lookup, from a local copy. An `invalid:origin` route is announced by an AS the holder's ROAs don't name: a hijack, or a ROA nobody updated.

## How we measured

Every figure is from the routing table and RPKI data of October 10. Route figures count each announced prefix once per origin AS, as BGP Route does. Address figures count each routed IPv4 address once, under the most specific route that announces it and, where several ASes originate that prefix, the one most of the routing table sees, as IP ASN does; bogon space and reserved AS numbers are left out. Network type and country are the origin AS's, from the ASN database. A collector peer is a network that shares its routes with a public route collector. From October 3 to 10 the valid share of routed IPv4 addresses stayed between 64.9% and 65.1%.

To license BGP Route, see [pricing](https://internetdata.io/pricing) or [talk to us](https://internetdata.io/contact).