RPKI Hits 200,000 Route Origin Authorizations
The Border Gateway Protocol (BGP) has a fundamental weakness: it trusts whatever its peers announce. Nothing stops a malicious or misconfigured network from advertising IP prefixes it doesn't own, leading to route hijacks that can take down major services. Routing Public Key Infrastructure (RPKI), first proposed in 2008, is designed to close that hole by giving network operators a cryptographic way to verify that a given Autonomous System (AS) is actually authorized to announce a specific prefix.
RPKI works in two parts. The five Regional Internet Registries — Afrinic, APNIC, ARIN, LACNIC, and RIPE NCC — act as Trust Anchors, cryptographically signing records called Route Origin Authorizations (ROAs) that state which network operators may announce which IP blocks. Network operators, in turn, download those ROAs, verify the signatures, and apply filters to incoming BGP announcements in a process known as Origin Validation.
The RPKI ecosystem has now crossed a notable threshold: more than 200,000 ROAs are in the database. That's roughly 25% of all routes on the Internet, up from about 172,000 at the start of 2020. Over the past year the count has grown by more than 70%, averaging a 5% monthly increase. The graph of daily ROA creation shows three distinct paces: 140 per day initially, then 231 per day, and since August, 351 new ROAs every day.
More Networks Are Validating
Having signed prefixes is only half the equation — networks must actually validate those signatures. The isbgpsafeyet.com test site, launched to check whether ISPs perform Origin Validation, has been visited over five million times from 223 countries and 13,000 unique networks — about 20% of the Internet — generating half a million validation tests.
The test works by querying two addresses: one behind an RPKI-invalid prefix and one behind a valid prefix. If a query toward the invalid address succeeds, that ISP is not performing Origin Validation. Data collected from the site and from RIPE Atlas probes shows a steady increase in successful (i.e., correctly blocked) tests of about 8% per month, with roughly 10 to 20 new networks deploying Origin Validation every month.
Major Transit Providers Lead the Way
Several large transit providers — including Cogent, GTT, Hurricane Electric, NTT, and Telia — have enabled Origin Validation. This is significant because downstream networks that connect through these Tier 1 providers get protection without deploying their own validation software. Many other providers announced on social media that they had RPKI deployments in progress after running the test.
The list of confirmed deployments, compiled with help from community contributors, excludes providers that block invalid prefixes through manual means such as firewall rules or static route rejection rather than through genuine RPKI validation. In one notable case, an ISP generated a more-specific blackhole route that leaked to multiple peers across the Internet.
A scan of the entire IPv4 address space using the same technique confirms the trend: far more networks are unreachable behind invalid prefixes than at the same time last year. The Hilbert Curve visualization below shows IPv4 space behind networks with Origin Validation enabled in yellow, overlaid on the blue of active address space.
The practical effect: if you were hijacking a prefix, users behind the yellow areas would not be affected by your attack. The same applies if a network operator miss-signs its own prefixes — it would lose reachability to those users and services.
Tools for a Safer BGP
Cloudflare's open-source tooling around RPKI has been growing alongside adoption. OctoRPKI, the company's RPKI validator, periodically generates a JSON document of validated prefixes that is passed to routers via GoRTR. Version 1.2.0, released at the end of October, includes security fixes, better memory management, and extended logging capabilities. It's the first validator to surface details on cryptographically invalid records to Sentry and to expose performance data to distributed tracing tools.
GoRTR itself remains widely used in production, including by transit providers, and can connect natively to other validators like rpki-client. Cloudflare also operates a public RTR server at rtr.rpki.cloudflare.com with plaintext and SSH endpoints for testing new versions before release.
The public rpki.json endpoint, first released in early 2019, lets anyone see what prefixes Cloudflare is filtering. The file is cached across more than 200 data centers, and is also used as a bootstrap by GoRTR for testing deployments. Between March 2019 and November 2020, queries to this endpoint more than doubled, with five times more networks requesting the file — growth that roughly tracks the 5% monthly ROA creation rate.
Dashboard and Historical Data
The public RPKI dashboard at rpki.cloudflare.com, launched in late 2019, offers a GraphQL API that lets users explore validation data, test prefix lists, and check the current routing table status. The API is used by BGPalerter, an open-source tool that detects routing anomalies from BGP update streams. As of November, the dashboard also exposes historical data back to May 2019, computed daily and including unique routing records for tracking ROA changes over time.
What Remains
At current growth rates, the RPKI ecosystem is nowhere near complete — 25% of routes are signed and about 20% of networks perform Origin Validation — but the dynamics are encouraging. The numbers grow every day, and the deployment of Origin Validation by the large transit providers disproportionately protects the networks behind them.
It's likely that BGP will become meaningfully safer before reaching full deployment. Once the remaining transit providers enable Origin Validation, a hijack attempt would be much less likely to make front-page news. We expect critical mass of protected resources to be reached in late 2021. In the near term, work continues on the open-source tooling, with a packaged version of GoRTR that can be installed directly on supported routers planned for release.
