RPKI now covers 67 percent of internet routes, but most networks still don't validate them
On June 29, 2026, RPKI coverage of the global internet routing table hit a record 67.43 percent — 1,065,730 of 1,580,470 announced prefixes now carry a signed Route Origin Authorization (ROA). That's genuine progress on a problem that's plagued the internet's core routing protocol, BGP, since the 1990s. But the milestone obscures a more important number: only 12.3 percent of autonomous systems (ASes) actually enforce full Route Origin Validation (ROV) on the routes they accept, while 36.2 percent don't validate at all.
That gap — between signing and enforcing — is the real story of internet routing security in 2026. Understanding why it exists, and why it matters, explains both real progress and a threat that hasn't gone away.
The problem RPKI was built to solve
BGP, the protocol that routes traffic between the roughly 70,000+ networks that make up the internet, was designed in an era when trust between operators was assumed. Any network can announce that it originates a block of IP addresses, and by default, other networks believe it. This makes BGP hijacking — where an attacker announces someone else's address space to redirect their traffic — trivially easy in the absence of validation. Historical incidents include traffic misdirection affecting major cloud providers, cryptocurrency exchanges, and government networks.
RPKI (Resource Public Key Infrastructure) addresses this by letting network operators cryptographically sign a statement: "this AS number is authorized to originate this IP prefix." Other networks can then check incoming route announcements against these signed statements — that's Route Origin Validation — and reject or deprioritize routes that don't match.
Why 67 percent coverage doesn't mean 67 percent protection
Signing a ROA is something a network operator does for their own address space — it's a unilateral, low-friction action. Enforcing ROV is different: it requires a network to actively reject or downrank routes that fail validation, which means trusting the RPKI system enough to let it affect real traffic decisions. That's a bigger operational commitment, and it's why enforcement lags coverage by a wide margin.
The practical consequence: an attacker can still successfully hijack a signed, protected prefix if enough of the networks along the path to potential victims aren't enforcing ROV. Qrator Labs documented seven global route leaks and one global BGP hijack in Q1 2026 alone — evidence that signing certificates hasn't yet translated into a routing system resistant to these attacks at internet scale.
The attacks RPKI doesn't stop
Even where ROV is fully enforced, RPKI has known blind spots. Research this year found that a sophisticated attacker doesn't need to fight a target's ROA directly — they can copy it. By announcing the victim's exact prefix with the victim's own AS number at the origin position, then prepending their own AS number in front of it, an attacker can construct a route that passes ROV checks while still hijacking traffic through their own network. RPKI validates origin, not path — and that's a structural limitation, not a bug that can be patched.
There's also a data-quality problem working against operators trying to interpret validation failures usefully: roughly 96.9 percent of RPKI-invalid prefixes found in the wild trace back to misconfiguration rather than active attacks. That noise makes it harder for network operators to build automated response systems that reliably distinguish a genuine hijack from someone's typo in a ROA record.
What actually needs to happen next
The path forward isn't more signing — coverage is already approaching two-thirds of the routing table. It's closing the enforcement gap. Large transit providers and content networks enforcing ROV on the routes they accept has an outsized effect, because it removes viable paths for hijacked traffic even when smaller downstream networks haven't adopted validation themselves. Path validation technologies (like BGPsec, which has seen minimal real-world deployment due to performance overhead) would close the AS-prepending gap, but adoption has stalled for years.
For network operators, the actionable step is straightforward: if you haven't enabled ROV enforcement on your border routers, that's a bigger security gain right now than signing additional ROAs for prefixes you already originate. The infrastructure to make BGP meaningfully safer already exists — most of the internet just hasn't turned it on yet.