The Internet's routing system just got substantially harder to hijack. RPKI — the cryptographic layer that lets address holders publish signed records of who may announce their routes — now covers 70.3% of routed IPv4 prefixes, up from 54% a year ago. That 16.4-point jump exceeds the prior two years combined (3.9 and 3.2 points respectively). The system is working as designed: valid routes reach 596 vantage points on average, while invalid ones reach just two. Nearly half of all invalid routes are visible to a single collector. The routing table is finally developing an immune system. The headline number, however, is overwhelmingly a China story. Chinese IPv4 addresses in valid routes went from 3.7% to 83.0% in a single year, accounting for roughly 60% of the global gain by address count. Remove China and the rest of the world gained 5.2 points — slightly less than the year before. Egypt (23% → 99%), Kazakhstan (16% → 84%), and Mexico (37% → 78%) also moved sharply, but China's sheer address mass dominated the math. As recently as December 2025, only 2.9% of China's prefixes were valid. The speed suggests centralized directive, not organic adoption. The geography of unprotected space is equally concentrated. Nearly 60% of all routed IPv4 addresses without RPKI coverage sit in the United States, with roughly a quarter belonging to the Department of Defense — largely address blocks announced starting in 2021 to detect misuse rather than run services. This means the global "unprotected" figure is partly an artifact of one government's network-monitoring strategy, not a failure of deployment. RPKI's blind spot matters more than its coverage gap. The protocol validates who may originate a prefix but says nothing about the path traffic takes afterward. On August 28, 2026, an attacker forged Hetzner's AS24940 as the origin for a /24 block, obtained a valid TLS certificate, and served malicious software updates — all while passing RPKI checks. The attack worked because Hetzner's ROA permitted announcements as small as /24 within its /16 block, and no legitimate /24 existed to compete. This is not a bug; it is a design boundary. RFC 9319 already recommends leaving maxLength unset, which would close this window, but adoption of that practice is spotty. The scale of this exposure is significant. Of 855,217 RPKI-covered IPv4 routes, 16.2% have a ROA looser than the announced route with no more-specific route filling the gap — roughly 18 million prefixes an attacker could announce today and appear RPKI-valid. Among hosting providers, Contabo (540 of 553 routes) and DigitalOcean (780 of 863) are nearly fully exposed; OVH sits at 11.5%. Access providers are worse: Cablevision at 98.1%, Shaw at 96.5%, Bharti Airtel at 85.0%. Hetzner itself tightened three prefixes after the incident but left 49 of 63 open. ROA maintenance failures show the system's operational fragility. Mauritius dropped from 94% to 69% coverage when SEACOM lost four of six ROAs on January 1, with a single /12 block covering 46% of the country's addresses still unsigned nine months later. Saudi Telecom lost protection on 1.6 million addresses for nearly six months before restoring ROAs. Orange Maroc's ROAs vanished twice, briefly leaving Morocco with near-zero coverage. These are not attacks — they are certificate-management lapses with country-level consequences. IPv6 has quietly overtaken IPv4. Routed IPv6 prefixes marked valid rose from 56% to 79%, putting it roughly ten points ahead of IPv4's 68%. Publication points grew from 73 to 91 as organizations began self-hosting repositories rather than relying on registries — a decentralization signal that strengthens the ecosystem's operational independence. The routing infrastructure is hardening, but the remaining gaps are structural and concentrated, not evenly distributed.
