Cloudflare analyzed adoption of RFC 9234, which introduces BGP Roles and the Only to Customer (OTC) attribute to let routers automatically detect and reject route leaks without hand-written policies. Using BMP data from its global peering, Cloudflare found 67 ASes setting OTC and, through a live announce/withdraw experiment with a tagged prefix, discovered two Tier-1 networks, GTT (AS3257) and Arelion (AS1299), stripping the OTC attribute — undermining route leak protection for downstream networks. After Cloudflare contacted them, Arelion rolled out a fix to preserve OTC, while GTT's configuration still strips it. The post also lists which router vendors support RFC 9234 as of August 2026 and urges operators to configure BGP Roles where supported.
Table of contents
Copy link Route leak prevention using BGP Roles and the OTC attributeCopy link Tracking adoption of RFC 9234 is challengingCopy link Experiment to find ASes stripping OTCCopy link Configure BGP Roles in your networkQuestions this post answers
What does RFC 9234 do to prevent BGP route leaks?
RFC 9234 defines BGP Roles and the Only to Customer (OTC) path attribute so routers can automatically detect and reject route leaks without hand-written policies. Each eBGP session gets a configured Role (Provider, Customer, Peer, RS, or RS-Client), and OTC marks a route once it has moved sideways or downward, so it can never legally propagate back upward; a router receiving an OTC-tagged route from a customer knows it is a leak and rejects it. Track how routing security standards like RFC 9234 mature by following BGP and networking coverage on daily.dev.
Which Tier-1 networks were found stripping the BGP OTC attribute?
GTT (AS3257) and Arelion (AS1299) were found stripping the Only to Customer (OTC) attribute from routes they forwarded. Cloudflare's experiment showed GTT consistently dropped OTC while Arelion did so inconsistently (71.4% of IPv4 and 40.7% of IPv6 affected paths). After being contacted, Arelion rolled out a fix to preserve OTC, while GTT's configuration still strips it, continuing to weaken RFC 9234's route leak protection through their networks. Developers debugging routing anomalies can follow real-world BGP incident analysis on daily.dev.
Which BGP implementations support RFC 9234 Roles and OTC as of August 2026?
Junos OS/Junos OS Evolved, RouterOS, BIRD, OpenBGPD, and FRR already support RFC 9234 configurations, with Cisco IOS XR support coming in the 26.4.1 release. Arista EOS, Nokia SR OS, Huawei, Extreme SLX-OS, ArcOS, GoBGP, and ExaBGP do not yet support it, meaning operators on those platforms cannot yet configure BGP Roles for automatic route leak prevention. Network engineers evaluating routing vendor roadmaps can track infrastructure updates like this on daily.dev.