--- title: RPKI now protects 70% of internet routes | daily.dev description: RPKI now secures 70.3% of global Internet routes, up from 54.0% a year earlier, with China's adoption leap (3.7% to 83.0%) driving most of the gain.... canonical: https://daily.dev/posts/rpki-now-protects-70-of-internet-routes-eduravykc twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: RPKI now protects 70% of internet routes | daily.dev og:description: RPKI now secures 70.3% of global Internet routes, up from 54.0% a year earlier, with China's adoption leap (3.7% to 83.0%) driving most of the gain.... og:url: https://daily.dev/posts/rpki-now-protects-70-of-internet-routes-eduravykc og:image: https://api.daily.dev/og/posts/eDURAVyKc.png og:image:alt: RPKI now protects 70% of internet routes og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # RPKI now protects 70% of internet routes **[Hacker News](https://daily.dev/sources/hn)** · 14 min read · 0 upvotes · 0 comments ## Summary RPKI now secures 70.3% of global Internet routes, up from 54.0% a year earlier, with China's adoption leap (3.7% to 83.0%) driving most of the gain. Measurements using vantage-point propagation show invalid routes barely spread (reaching only ~2 collectors on average vs ~596 for valid ones), meaning raw invalid-route percentages often exaggerate real-world impact, as seen in Spain and Slovakia. However, RPKI only validates origin, not path: a August 2026 Hetzner hijack exploited a loosely scoped ROA to forge a route and serve malware, and roughly 16-21% of covered routes still have such 'open windows.' ASPA, a newer path-validation layer, is growing fast (131 to 3,272 publishing networks in a year) but still only meaningfully validates about 3.5% of routing, with Syrian Telecom's incomplete records responsible for about a quarter of global ASPA failures. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What percentage of Internet routes are protected by RPKI now compared to last year RPKI-valid routes cover 70.3% of routed prefixes, up from 54.0% a year earlier, a 16.4 percentage point gain. Measured by IPv4 addresses, the share rose from 53.1% to 65.0%. Much of the jump came from China, which went from 3.7% to 83.0% of its IPv4 addresses in valid routes, accounting for nearly 60% of the global gain. _Tracking routing security trends like RPKI adoption is easier with daily.dev's developer news coverage._ ### Can an RPKI-valid route still be used in a BGP hijack Yes, because RPKI only validates who may originate a prefix, not the path, and it cannot stop an attacker operating inside a ROA's permitted range. On August 28, 2026, an attacker forged Hetzner's AS24940 as the origin of a /24 inside a /16 ROA that allowed smaller announcements, producing an RPKI-valid route used to obtain a TLS certificate and serve malicious software. Roughly 16.2% of IPv4 and 20.9% of IPv6 RPKI-covered routes have this kind of loose 'open window.' _Developers hardening BGP configurations can follow routing security writeups like this via daily.dev._ ### What is ASPA and how widely is it deployed in BGP routing ASPA (Autonomous System Provider Authorization) is a signed record naming a network's authorized upstream providers, letting others validate observed AS paths and catch route leaks that origin validation like RPKI misses. Adoption grew from 131 publishing networks on September 28, 2025 to 3,272 a year later, a 25x increase, though it only meaningfully validates about 3.5% of observed routing so far. _Engineers evaluating emerging BGP security standards like ASPA can keep up through daily.dev._ ## Community take How the wider developer community reacted, aggregated from 1 discussion and 88 comments across hackernews (as of 2026-10-16). **TL;DR:** The technical content (RPKI adoption, ASPA growth) got relatively little direct engagement; most of the discussion spiraled into a geopolitical debate about whether centralized registries could be used to cut a country off the internet, plus complaints about the article's AI-generated writing style. **Sentiment:** 10% positive · 15% mixed · 75% skeptical **The case for** - Some note real-world adoption momentum, with one commenter mentioning their org pushed to make routes RPKI-valid and is now considering ASPA. - A few argue that making it easier to isolate a bad-faith actor from the internet wouldn't necessarily be bad. **The pushback** - Many worry that centralizing route authority in a single registry/country creates a single point of political leverage that could be abused to cut off a nation's internet access. - Some argue RPKI undermines the internet's intended decentralization and could be bypassed anyway if enforcement were weaponized (operators would just disable validation). - Several commenters criticized the post's writing as bloated, AI-generated 'slop' and asked for raw bullet points instead of prose. - Some note RPKI doesn't address path validation, and ASPA adoption is still very early/low coverage. **By community** - hackernews (heated): The thread mostly abandoned the RPKI technical news in favor of a heated, sprawling argument about internet centralization, geopolitics, and whether registries could be weaponized against countries like Russia, with a side current complaining about the article's AI-sounding prose. **Hottest debate:** Whether centralizing route authority in RPKI registries creates a dangerous single point of political control that could be used to cut a country off from the internet. **Open questions** - Would operators actually comply with or defect from RPKI enforcement if it were used for geopolitical pressure? - Is there a viable path to a non-centralized or alternative trust anchor for RPKI if an existing registry were compromised or weaponized? **Highlights** > My concern about RPKI is legal pressure on the registries. By centralising all of Russia's allowed routes on a database server in the Netherlands and automatically enforcing it, it's trivial for the Dutch government to cut off Russia's internet access by tampering with that database. > — [cowlevel on hackernews · 15 comments](https://news.ycombinator.com/item?id=50112640) > Without RPKI, it would be easy for many governments to cut off Russia's internet access by launching a BGP attack. Assuming the Netherlands was acting unnilaterally, Russian ISPs would be able to coordinate with other ISPs to get back online via other routes. Assuming Russia's enemy wanted to press the issue, it would quickly devolve into a political question of who wants to allow Russian peering, who does not, and who is willing to not peer with peers of Russia (and peers of peers, etc). This has always been the case. The internet is a network of networks; all of which are subject to control by their host governments should they choose to exercise it. With or without RPKI, a partitioning of the Internet for a significant period of time was always going to be a political decision. > — [gizmo686 on hackernews · 1 comments](https://news.ycombinator.com/item?id=50113134) > If that were to happen, everybody in Russia would just turn RPKI enforcement off, so this would only turn off their internet access for a few hours at most. See the recent .de DNSSEC failures [0] for an example of this. Also, the registries are already capable of unilaterally transferring Russia's IP space to somebody else, so if they transferred it to AWS (for example) and they immediately started using it, this would have a similar effect, except this couldn't be fixed by toggling a switch, since it would mean that people would need to choose between connecting to either Russia or AWS. [0]: https://blog.cloudflare.com/de-tld-outage-dnssec/ > — [gucci-on-fleek on hackernews · 1 comments](https://news.ycombinator.com/item?id=50114530) > I love wading through LLM prose! I know its a tired point, but why not publish the bullet points that were the source for this text as well. I'd rather read that. Getting another LLM to summarise back to something concise just seems wrong. > — [phatfish on hackernews · 1 comments](https://news.ycombinator.com/item?id=50116984) > > Much of the jump came from one country: China went from 3.7% of its IPv4 addresses in valid routes to 83.0%, almost 60% of the global gain counted by addresses. Interesting. China may have predicted cyber attacks in the near future. Or perhaps are readying for retaliation. It's possible their military or intelligence branches didn't anticipate this getting published. (Unless somebody knows if this year just happened to be when they decided to implement cyber reforms?) Hey, IPInfo: Can you please add to your AGENTS.md an instruction to break up long boring writing with some metaphors, comparisons, and transitionary paragraphs? Reading that was like reading tax returns. > — [0xbadcafebee on hackernews · 2 comments](https://news.ycombinator.com/item?id=50114100) **Source threads** - [hackernews](https://news.ycombinator.com/item?id=50112330) · 192 points · 88 comments ## Similar posts on daily.dev - [Who’s running all those tiny RPKI servers?](https://daily.dev/posts/who-s-running-all-those-tiny-rpki-servers--ota2fdoxt) · Hacker News · 0 upvotes · 0 comments - [ASPA: making Internet routing more secure](https://daily.dev/posts/aspa-making-internet-routing-more-secure-r19ceuyg1) · Cloudflare · 0 upvotes · 0 comments - [Cloudflare Introduces Support for ASPA, an Emerging Internet Routing Security Standard](https://daily.dev/posts/cloudflare-introduces-support-for-aspa-an-emerging-internet-routing-security-standard-9fcps0m7k) · InfoQ · 0 upvotes · 0 comments - [How far can you go with IX Route Servers only?](https://daily.dev/posts/how-far-can-you-go-with-ix-route-servers-only--pzqn4hqop) · Benjojo's Blog · 0 upvotes · 0 comments - [A framework for measuring Internet resilience](https://daily.dev/posts/a-framework-for-measuring-internet-resilience-ej9eg4ku0) · Cloudflare · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#bgp](https://daily.dev/tags/bgp) [View this post on daily.dev](https://daily.dev/posts/rpki-now-protects-70-of-internet-routes-eduravykc) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"RPKI now protects 70% of internet routes","url":"https://daily.dev/posts/rpki-now-protects-70-of-internet-routes-eduravykc","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/rpki-now-protects-70-of-internet-routes-eduravykc"},"datePublished":"2026-10-16T04:00:49.497Z","dateModified":"2026-10-16T14:17:19.941Z","description":"RPKI now secures 70.3% of global Internet routes, up from 54.0% a year earlier, with China's adoption leap (3.7% to 83.0%) driving most of the gain....","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fe0f7366207e3e7c156f1dc8b0560f2f?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/fe0f7366207e3e7c156f1dc8b0560f2f?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"Hacker News","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"Hacker News","logo":"https://media.daily.dev/image/upload/t_logo,f_auto/v1/logos/hn","url":"https://daily.dev/sources/hn"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/rpki-now-protects-70-of-internet-routes-eduravykc","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,bgp","timeRequired":"PT14M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"Hacker News","item":"https://daily.dev/sources/hn"},{"@type":"ListItem","position":3,"name":"RPKI now protects 70% of internet routes"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/rpki-now-protects-70-of-internet-routes-eduravykc#faq","mainEntity":[{"@type":"Question","name":"What percentage of Internet routes are protected by RPKI now compared to last year","acceptedAnswer":{"@type":"Answer","text":"RPKI-valid routes cover 70.3% of routed prefixes, up from 54.0% a year earlier, a 16.4 percentage point gain. Measured by IPv4 addresses, the share rose from 53.1% to 65.0%. Much of the jump came from China, which went from 3.7% to 83.0% of its IPv4 addresses in valid routes, accounting for nearly 60% of the global gain. Tracking routing security trends like RPKI adoption is easier with daily.dev's developer news coverage."}},{"@type":"Question","name":"Can an RPKI-valid route still be used in a BGP hijack","acceptedAnswer":{"@type":"Answer","text":"Yes, because RPKI only validates who may originate a prefix, not the path, and it cannot stop an attacker operating inside a ROA's permitted range. On August 28, 2026, an attacker forged Hetzner's AS24940 as the origin of a /24 inside a /16 ROA that allowed smaller announcements, producing an RPKI-valid route used to obtain a TLS certificate and serve malicious software. Roughly 16.2% of IPv4 and 20.9% of IPv6 RPKI-covered routes have this kind of loose 'open window.' Developers hardening BGP configurations can follow routing security writeups like this via daily.dev."}},{"@type":"Question","name":"What is ASPA and how widely is it deployed in BGP routing","acceptedAnswer":{"@type":"Answer","text":"ASPA (Autonomous System Provider Authorization) is a signed record naming a network's authorized upstream providers, letting others validate observed AS paths and catch route leaks that origin validation like RPKI misses. Adoption grew from 131 publishing networks on September 28, 2025 to 3,272 a year later, a 25x increase, though it only meaningfully validates about 3.5% of observed routing so far. Engineers evaluating emerging BGP security standards like ASPA can keep up through daily.dev."}}]} ```