RPKI‑validated routes now cover 70% of the global routing table, a leap largely powered by China’s policy shift.
RPKI SECURES 70% OF GLOBAL INTERNET ROUTES, CHINA DRIVES SURGE
*RPKI validation now covers 70.3% of routed prefixes, up from 54.0% a year ago. The jump is almost entirely due to China’s rapid adoption, reshaping the global security baseline.*
The Border Gateway Protocol still underpins every packet that traverses the public Internet, but its trust‑based design leaves it vulnerable to mis‑announcements. Resource Public Key Infrastructure (RPKI) was built to seal that gap by letting address holders publish signed authorisations. A new analysis shows RPKI now validates 70.3% of routed prefixes, a leap from 54.0% just twelve months earlier. The surge is not a gradual trend; it is a sharp inflection driven largely by one nation’s policy shift. The numbers are stark, the implications immediate, and the window for complacency closing fast.
Global RPKI Adoption Hits 70%
The share of routed prefixes that are RPKI‑valid rose from 54.0% in September 2025 to 70.3% in September 2026, a gain of 16.4 percentage points or a 30% increase in a single year. In the two years before, growth stalled at three to four points annually. Data pulled on September 28 each year cover 1,614,288 prefixes. A typical valid prefix appears in 596 RIPE RIS and RouteViews routers, compared with 595 for prefixes without any RPKI record and just two for invalid prefixes. RPKI‑related BGP updates remain under 1% of daily volume, confirming the system is not destabilising routing.
China's Massive Shift
China accounted for almost 60% of the global gain. Its IPv4 addresses in valid routes jumped from 3.7% in September 2025 to 83.0% a year later. At the end of December 2025, only 2.9% of China’s routed prefixes were valid; by September 2026 the figure topped 80%. The surge flipped China’s impact on the global average: worldwide RPKI‑valid routes rose from 53.1% in 2025 (when China pulled the figure down) to 65.0% in 2026 (when China pushed it up). Outside China, the share rose from 58.0% to 63.2%, a modest five‑point gain.
Invalid Routes Remain Marginal
Invalid announcements barely propagate. Only two routers on average see an invalid prefix, versus roughly 596 for valid ones. Seventy‑one percent of wrong announcements reach a single vantage point. Spain shows the highest raw share of invalid IPv4 prefixes at 28.2%, but when weighted by visibility the figure collapses to 0.057%. Slovakia’s weighted share falls from 17.4% to almost zero. Italy’s weighted share sits at 0.121%, up from 0.075%, driven 90% by a single network, WIND TRE (AS1267), which announced 34 routes that its own ROAs reject.
Implications for Routing Stability
The data suggest RPKI is finally achieving its defensive purpose. Networks that check RPKI are dropping invalid routes, limiting their reach to a handful of peers. The modest share of RPKI activity in BGP updates (<1%) indicates the system is not a source of churn. As more operators adopt validation, the barrier to accidental or malicious hijacks rises. The rapid Chinese adoption shows policy can shift the global security posture dramatically, hinting that other large registries could trigger similar swings.
With three‑quarters of the Internet now shielded by cryptographic route authorisations, the era of unchecked BGP hijacks is waning. Yet the story is unfinished: the next wave will depend on whether other large registries follow China’s lead or lag behind. Until the remaining 30% of routes adopt RPKI, the global routing fabric remains partially exposed. The clock is ticking, and every unprotected prefix is a potential foothold for disruption.
Sources: Hacker News article "RPKI now protects 70% of internet routes" (IPinfo.io)