Routing Security Update#

Brad Gorman, ARIN (Director, Customer Technical Services)

• Why: The best single data source on where RPKI actually stands in the ARIN region — which is directly actionable when prioritizing your own ROA coverage and when deciding how much to lean on ROV in filtering. Also the first production deployment of ASPA objects worth watching.
• What: A quarter-over-quarter adoption report plus new features. Key numbers (NIST RPKI monitor, 1 April): global RPKI validity has climbed steadily through Q1 2026, with IPv4 and IPv6 both in the roughly 60–66% range. In-region: 8,403 organizations registered for ARIN RPKI services (25% growth since Q1 2025), 98% of them on Hosted RPKI — but ~15% of registered orgs have never created a single ROA, only 50% of RPKI-eligible IPv4 blocks are covered by ROAs, and 54% of ARIN-registered IPv4 blocks seen in announcements are RPKI Valid. ASPAs are live in production (198+ created and trending up), enabling IETF draft testing with real data. An upcoming "RPKI Routing Intelligence" feature will show orgs their prefixes as seen in the global BGP table, explain why announcements are Invalid or Not Found, and simulate the effect of proposed ROA changes.
• How: The update combines NRO/NIST monitoring data with ARIN's own registry cross-referencing (allocations under agreement vs. ROA coverage vs. announcements). The Routing Intelligence feature is essentially a BGP-table diff against your resource certificate with counterfactual analysis.
• Where applicable: The stats are ARIN-region-specific, but the gap they expose (signup ≠ protection; the bottleneck is ROA coverage, not registration) generalizes. The Routing Intelligence preview matters to any ARIN resource holder; worth benchmarking your own coverage against the 50%-of-eligible-blocks regional figure.