RPKI

What RPKI is

The routing system of the internet, BGP, was designed on trust: any network can announce any block of addresses, and the rest of the internet believes it. Resource Public Key Infrastructure adds a cryptographic statement to that system. The holder of an IP block, using a certificate issued by its regional registry, publishes a Route Origin Authorization (ROA) that says "this prefix, up to this length, may be announced by this ASN". The ROAs sit in public repositories run by the five registries; networks download them with a validator (Routinator, rpki-client, FORT) and compare every route they receive against the list.

Each route then has one of three states. Valid means a ROA covers the prefix and names the announcing AS. Invalid means a ROA covers the prefix but the announcement does not match it, either because a different AS originates the route or because the announced prefix is more specific than the ROA allows. Unknown (also written "not found") means no ROA covers the prefix at all, which is still the case for a sizeable minority of the IPv4 table. Invalid routes are what the system exists to catch: a typo in a router configuration, or a deliberate hijack of someone else's addresses.

Why it matters

A growing share of large networks, including the biggest transit providers and cloud platforms, drop RPKI-invalid routes. An address inside an invalid prefix is therefore partly unreachable: traffic from networks that filter never arrives, and the holder may not notice until customers complain. For a reputation check this is a useful, free signal. Legitimate operators keep their ROAs in order, so an invalid status on an address you are evaluating means either a misconfigured network or a hijacked block, both of which belong in the "risky" column. Unknown is neutral; it just says the holder has not signed anything yet.

How we check it

The routing panel on every IP page asks the RIPE NCC's RIPEstat service for the validation state of the prefix that currently covers the address and its origin AS (the rpki-validation call), and shows the result next to the announced prefix, the share of RIS collectors that see the route and the date the route was first observed. The answer is cached for six hours. An Invalid result, or a prefix that is not announced at all, costs ten points in the purity score; Valid and Unknown cost nothing. When RIPEstat cannot be reached the panel says Unavailable and the score simply skips the factor rather than guessing. The data is published under the RIPE NCC's terms and is credited on the panel.