September 1, 2026

RPKI in Plain English: Stop Origin Hijacks Before They Start

BGP will accept a lie if operators let it. RPKI is a signed note from the resource holder that says which ASN may originate a prefix. Route Origin Validation is the act of checking that note before installing a route.

The problem RPKI was built to shrink

Anyone with a BGP session can announce a prefix they do not hold. Peers may accept it. The rest of the internet may prefer it if the path looks attractive. That is a hijack when it is deliberate, and a leak when it is a mistake. Users see wrong websites, blackholed payment pages, or silent interception.

IRR objects tried to document intent. They are useful and often stale. RPKI adds a cryptographic chain from RIR to ROA. A Route Origin Authorization states: this ASN may originate this prefix up to this maximum length.

The three results you will see

Valid — a covering ROA exists and the origin ASN plus prefix length fit. Keep the route if policy allows.

Invalid — a covering ROA exists and this announcement violates it. Wrong origin, or a more-specific longer than maxLength. Networks that enforce ROV should drop this.

Not found / unknown — no ROA covers the prefix. Older space and small operators still live here. Unknown is not invalid. Do not treat it as a hijack by itself.

How to check a prefix today

Take the prefix and origin from IP Lookup. Paste both into the RPKI Validator. If you only have an address, resolve the covering prefix first. Validating a host address without the announced block misses maxLength mistakes.

When a popular service breaks in several countries at once, check RPKI before you reboot a firewall. An invalid origin that suddenly appears is a routing incident, not an app deploy.

What operators should publish

• ROAs for every prefix you originate, including aggregates you actually announce.
• A maxLength no tighter than you need. Over-wide maxLength lets an attacker more-specific you from the same ASN if they ever get a session; over-tight maxLength invalidates your own more-specifics.
• ROAs before you flip ROV on your own edge, or you will blackhole yourself.

What this does not fix

RPKI origin validation does not prove the AS path is honest. A valid origin can still be reached through a leaked path. Path validation (ASPA and related work) is a different layer. RPKI also does not replace access lists, prefix filters, or max-prefix on peering sessions. It is one gate, not the whole fence.

Validate a prefix you own and one you do not. If yours is unknown, that is a homework item with your RIR or hosting provider — not a reason to ignore RPKI.

How a small network should publish ROAs

If you hold a prefix from an RIR or a delegated block from a parent who will sign for you, create a ROA per announcement you actually make. Match origin ASN exactly. Set maxLength to the longest prefix you plan to announce in normal operations. If you only ever announce /24s, do not authorize /32. Revisit ROAs when you add a second origin for multihoming — two origins need two ROAs or one of them becomes invalid the day you enable ROV somewhere important.

Hosted customers should ask the provider who originates the space. Many “we were unreachable in Europe” postmortems are a forgotten ROA after an ASN migration.

How a network should consume ROAs

Run a validator that talks to the RIR trust anchors. Feed ROV into the border policy: invalid drop, valid prefer, not-found treat as you treat unsigned space today. Dropping not-found is still too aggressive for the whole default-free zone. Dropping invalid is table stakes in 2026.

Test with the RPKI Validator before you enforce. If a customer prefix shows invalid, fix the ROA first. Enforcement without inventory is an outage you scheduled yourself.

FAQ

FAQ

Does invalid always mean a hijack?

No. Mis-issued ROAs and forgotten more-specifics cause valid networks to look invalid. Still treat invalid as “do not prefer.”

Can a home user deploy RPKI?

You consume it by choosing ISPs and resolvers that take routing hygiene seriously. Publishing ROAs is for resource holders.