RPKI now validates 70% of internet routes, with China driving the jump

Seventy percent of the internet's routed prefixes now pass RPKI validation, according to measurement work published by IPinfo. The share of prefixes marked valid rose from 54.0% in September 2025 to 70.3% in September 2026, a gain of 16.4 percentage points — larger than the increases of the previous two years combined.

Routing on the internet has always run on trust: networks exchange BGP announcements declaring which IP address blocks they can deliver traffic to, with no built-in check that a declaration is legitimate. The canonical cautionary tale, documented in a RIPE NCC case study, came on February 24, 2008, when Pakistan Telecom announced YouTube's addresses to block the service locally and the route leaked worldwide through PCCW Global, knocking YouTube offline for roughly two hours. RPKI, the Resource Public Key Infrastructure, is the industry's structural fix: the holder of an address block publishes a signed record called a Route Origin Authorization naming the autonomous systems allowed to announce it, and operators that validate can reject announcements that fail the check.

China drove most of the gain

Measured by IPv4 addresses rather than prefix count, the globally valid share went from 53.1% to 65.0% over the year, and almost 60% of that increase came from one country. China moved from 3.7% of its IPv4 addresses sitting in valid routes to 83.0%, having stood at just 2.9% of valid prefixes as late as the end of December 2025. The swing was large enough to flip China's effect on the world figure: in 2025 it dragged the global average down; in 2026 it pushed it up. Outside China, the gain was 5.2 points, from 58.0% to 63.2%. IPinfo records sharp moves elsewhere too: Egypt from 23% to 99%, Kazakhstan from 16% to 84%, Mexico from 37% to 78% and South Africa from 38% to 60%.

Invalid routes barely propagate

Validation only protects routing if networks actually discard what fails, and IPinfo's data indicates they now do. Across 1,614,288 routed prefixes on September 28, 2026, a typical valid prefix was visible from 596 of the vantage points feeding the RIPE RIS and RouteViews collectors, and a prefix with no RPKI record from 595. A prefix failing validation was seen by just two. Nearly half of all invalid routes reach only a single vantage point, and 71% do so when the wrong network originates the block — the most unambiguous form of hijack or error.

That finding also recasts country-level statistics, since a country can look bad on the strength of announcements almost nobody sees. Spain has the highest share of invalid IPv4 prefixes at 28.2%, but weighting by addresses and visibility collapses the figure to 0.057%. Italy leads among countries with at least a million IPv4 addresses at 0.121%, and 90% of that traces to a single network, WIND TRE, whose announcements partly contradict its own authorizations.

The unprotected space that remains is highly concentrated: nearly 60% of routed IPv4 space outside valid routes sits in the United States, and roughly one address in four belongs to the US Department of Defense, which began announcing much of that space in 2021 to watch for misuse rather than run services.

IPv6 has pulled ahead

Fears early in 2025 that IPv6 adoption of RPKI was slowing proved wrong. Valid IPv6 prefixes rose from 56% to 79% while IPv4 went from 54% to 68%, reversing the stalling pattern Job Snijders described in RIPE Labs' 2024 year in review. IPinfo also notes that publication points climbed from 73 to 91 as more organizations began hosting their own repositories, and the average number of blocks per ROA recovered from 2.31 to 2.62. Separately, the Internet Society Pulse found in August that RPKI-related activity accounts for under 1% of daily BGP update volume, so the growth is not destabilizing routing.

What RPKI still cannot stop

RPKI checks who may originate a prefix, not the path a route travels, and it cannot catch an attacker who stays within the permissions an operator published. On August 28, 2026, a forged route for 162.55.80.0/24 carrying Hetzner's ASN as its origin passed validation because Hetzner's ROA covered the surrounding /16 and permitted announcements as small as a /24; as documented by Kentik, the route was then used to obtain a genuine TLS certificate and serve a malicious Virtualizor update to hypervisors. Nothing in RPKI malfunctioned — the ROA simply allowed it. IPinfo measured that 16.2% of 855,217 RPKI-covered IPv4 routes have ROAs looser than the announced route with no more-specific route filling the gap, roughly 18 million prefixes an attacker could announce today with a forged origin and still register as valid.

Why it matters

BGP hijacks, whether fat-fingered or deliberate, can divert traffic to an eavesdropper or take entire services offline, and for decades there was no systemic defense. Crossing 70% coverage — with invalid routes now effectively stopped from spreading — is the first hard evidence that origin validation works at internet scale. But the milestone is uneven. The remaining unsigned space is concentrated in US government holdings, and loose ROAs leave millions of prefixes attackable while looking perfectly legitimate. Coverage was the easier half of the problem; tightening authorizations and validating paths is the harder work still ahead.