RPKI: stop anyone from hijacking your IP addresses

The internet forwards packets based on announcements: networks tell their neighbours "you reach these IP ranges through me". This system (BGP) largely trusts such announcements blindly. If someone — by accident or malice — announces your addresses, traffic to you can be diverted. That's called route hijacking.

What RPKI does

RPKI (Resource Public Key Infrastructure) cryptographically states which network (which AS number) is authorised to announce an IP range — a so-called ROA (Route Origin Authorization). Routers can then check: does the announcement match the authorised origin?

• Valid: the announcement comes from the authorised network.
• Invalid: someone unauthorised announces the range — a warning sign that many networks drop.
• Not found: no ROA published — neither proof nor objection.

Why it matters

Without RPKI, a misrouting is hard to tell apart from an attack. With published ROAs a large part of the internet can automatically reject false announcements — your traffic stays on the right path and your users reach the real server.

What you can do

RPKI is implemented at your network operator / data centre level: valid ROAs should exist for your IP ranges. We check, for the IP addresses of your web, name and mail servers, whether their origin is RPKI-validated — an often overlooked but important building block of reachability.