RPKI validity

What route origin validation does

BGP lets any network announce any address block. RPKI lets the holder of a block sign a Route Origin Authorisation (ROA) at their regional internet registry, saying which AS may originate it and how specific the announcement may be (maxLength).

Routers that validate compare each route with the ROAs. A route is valid when a ROA matches its origin and length, invalid when ROAs cover it but none match, and not found when no ROA covers it. Most large transit providers and many access networks drop invalid routes, so an invalid route is unreachable from a large part of the internet.

What you can check

• An IP address or a domain: the route that carries it in the global routing table, its origin AS, its validity, the ROAs that decide it, and how many RIPE RIS peers see it.
• A prefix, optionally with an origin AS, to see whether a planned announcement would be accepted before you make it.
• An AS number: every prefix it announces, which are valid, invalid or without a ROA, ROAs that match no route, and ROAs whose maxLength is longer than anything announced.

Routing and RPKI data come from RIPEstat, validated against the trust anchors of all five registries.

Fixing an invalid or unprotected route

• Invalid because of the origin: the ROA names a different AS, often after moving to a new transit provider or a DDoS protection service. Add a ROA for the AS that now announces the prefix, before it starts announcing.
• Invalid because of the length: the announcement is more specific than the ROA's maxLength allows, often a /24 carved from a /22 for traffic engineering. Add a ROA for the more specific prefix.
• Not found: create a ROA in your registry's portal (ARIN, RIPE NCC, APNIC, LACNIC or AFRINIC). It takes a few minutes, and validators pick it up within an hour.
• Keep maxLength equal to the length you announce (RFC 9319). A /22 ROA with maxLength 24 lets anyone forge your AS as the origin of a /24 and win traffic on longest match.

Questions

How long does a new ROA take to work?

Validators fetch the RPKI repositories every 10 to 60 minutes and routers refresh from them shortly after, so expect up to about an hour. Create the ROA before changing an announcement, not after.

Does RPKI stop all hijacks?

No. It checks only the origin AS, so an attacker who forges your AS number at the start of the path still passes. Keeping maxLength tight limits that, and ASPA, which checks the path, is being rolled out to close the gap.

What does a ROA for AS0 mean?

An AS0 ROA says the space must not be announced at all. Registries publish them for unallocated space, and holders can use them for blocks they don't route, so any announcement of that space is invalid.

Why is a route valid here but unreachable for some users?

Validity only says the origin is authorised. Reachability also depends on filtering, peering and outages; the visibility figure shows how many route collectors see the prefix at all.