RPKI Now Protects 70% of Internet Routes, IPinfo Finds

A security system that stops networks wrongly claiming other people’s internet addresses now covers most of the internet’s routes, according to new measurements from IP data company IPinfo. It found that 70.3% of routed prefixes were RPKI-valid in September 2026, up from 54.0% a year earlier.

The figures are IPinfo’s own, published in an IPinfo blog post by João Tomé, using a data snapshot from 28 September 2026.

What RPKI does

Networks on the internet tell each other which blocks of IP addresses they can deliver traffic to, using the Border Gateway Protocol (BGP). Those announcements have historically relied on trust. If a network announces addresses it should not, by mistake or deliberately, traffic can be sent to the wrong place.

RPKI (Resource Public Key Infrastructure) lets the holder of a block of addresses publish a signed record, called a Route Origin Authorization (ROA), naming which networks may announce it. Networks that check RPKI can reject announcements that fail. IPinfo points to a 2008 incident in which Pakistan Telecom’s announcement redirected YouTube traffic worldwide for about two hours as “exactly the kind of error RPKI is designed to prevent.”

The headline numbers

According to IPinfo:

Routed prefixes: RPKI-valid share rose “from 54.0% in September 2025 to 70.3% in September 2026,” a gain of 16.4 percentage points. In each of the two previous years it rose about three to four points.
By IPv4 addresses: the share in valid routes rose from 53.1% in 2025 to 65.0% in 2026.
IPv6: valid routed prefixes rose from 56% to 79%, putting IPv6 ahead of IPv4.

IPinfo notes that if prefixes seen by only one monitoring point are excluded, the figure is 71.4%.

China drove much of the jump

China went from 3.7% of its IPv4 addresses in valid routes to 83.0%, which IPinfo says was almost 60% of the global gain counted by addresses. Outside China, the share rose from 58.0% to 63.2%. Other large moves included Egypt (23% to 99%), Kazakhstan (16% to 84%) and Mexico (37% to 78%).

Coverage can also fall. IPinfo says Mauritius dropped from 94.0% to 69.0% after a large network’s records disappeared at the start of the year.

Invalid routes barely travel

IPinfo’s data suggests RPKI is working. A typical valid route is seen by 596 of the monitoring points that feed the public RIPE RIS and RouteViews collectors, and a route with no RPKI record by 595. An invalid route is seen by just two. In other words, enough networks now check RPKI that bad routes are mostly dropped.

What RPKI does not do

IPinfo stresses that RPKI is “not bulletproof.” It checks only who may originate a route, not the path traffic takes.

It also cannot stop an attacker who stays within the permission a network has published. IPinfo describes an August 2026 case, documented by Kentik, in which an attacker announced a small block inside Hetzner’s address space with Hetzner’s network forged as the origin. Because Hetzner’s record allowed small sub-blocks, the forged route was RPKI-valid.

IPinfo found that 16.2% of RPKI-covered IPv4 routes, and 20.9% for IPv6, have such an “open window.” It notes that best-practice guidance, RFC 9319, is to leave the “maxLength” setting unset so a record covers only the block actually announced.

A newer system, ASPA, aims to check paths too. IPinfo counts networks publishing ASPA records rising from 131 to 3,272 in a year, though it says ASPA can check only a small slice of routing so far.

What network operators can do

IPinfo’s advice to operators: publish ROAs for everything they announce, leave maxLength unset, check that their records are still in place, and publish ASPA records listing every provider.

What’s still unknown

These are one company’s measurements from public data; other measurement methods may give different figures. IPinfo itself warns that some methods count records as failed even when they still protect routes.

What to watch

Watch for figures from regional internet registries and other monitors, and for faster ASPA adoption as more registries offer signing tools.

What this means

Most routes protected. IPinfo measures 70.3% of routed prefixes as RPKI-valid.
Bad routes are dropped. Invalid routes reach a median of just two monitoring points.
Gaps remain. Loose records and unchecked paths still leave room for hijacks.