RPKI (Resource Public Key Infrastructure) allows holders of IP address blocks to publish Route Origin Authorizations (ROAs) that specify which autonomous systems may announce those prefixes. Networks that check RPKI can reject announcements that do not match a valid ROA, helping to prevent route hijacks and accidental mis‑configurations.
According to the source, the proportion of routed prefixes that are RPKI‑valid increased from 54.0% in September 2025 to 70.3% in September 2026, a gain of 16.4 percentage points, or roughly a 30% increase over one year. In the two preceding years the metric rose only three to four points annually, making the 2025‑2026 jump notably sharp.
Much of this increase came from a single country: China. The source notes that China’s share of IPv4 addresses in valid routes climbed from 3.7% in September 2025 to 83.0% a year later, accounting for almost 60% of the global gain measured by address volume. At the end of December 2025, only 2.9% of China’s routed prefixes were valid, indicating that most of the improvement occurred during 2026.
When China’s figures are excluded, the worldwide share of RPKI‑valid routes rose from 58.0% to 63.2% between the same periods, a 5.2‑point increase—still larger than the previous yearly gains but far smaller than the overall jump. Other countries also showed strong progress: Egypt moved from 23% to 99%, Kazakhstan from 16% to 84%, Mexico from 37% to 78%, and South Africa from 38% to 60%.
The source adds that RPKI does not destabilize routing; Internet Society Pulse found RPKI‑related activity accounts for under 1% of daily BGP update volume. Valid prefixes are typically seen by about 596 vantage points in the public RIPE RIS and RouteViews collectors, while invalid prefixes are seen by only two, showing that networks that check RPKI are effectively dropping bogus announcements.
Despite its strengths, RPKI only validates the origin of a prefix, not the path. The source cites an example from August 28 2026 where a forged route for 162.55.80.0/24 was accepted as RPKI‑valid because the originating AS’s ROA allowed the longer prefix, enabling a malicious Virtualizor update. The analysis showed that roughly 16.2% of RPKI‑covered IPv4 routes have a ROA that is looser than the announced route and lack a more‑specific competing route, leaving millions of prefixes potentially exploitable in a similar fashion.
Overall, the data indicate that RPKI is moving from a niche security tool to a baseline component of global routing hygiene, though operators still vary widely in how tightly they configure their ROAs.