Current Status of RPKI — ROAs and ASPAs Across the Internet

RPKI (Resource Public Key Infrastructure) lets an Autonomous System prove two things with a cryptographic signature instead of just trusting BGP announcements: Whether any ASN is actually allowed to originate any given IP prefix, and whether it is actually allowed to sit in the path as someone's transit provider. A ROA (Route Origin Authorization) covers the first case — it stops one network from announcing someone else's IP range by mistake or on purpose. An ASPA (Autonomous System Provider Authorization) covers the second — it stops route leaks, where a network accidentally forwards a route to the wrong upstream.

The Global Picture

As of this refresh, here is ASPA adoption across all five Regional Internet Registries:

ROA Publication — the Mature Baseline

Unlike ASPA, ROA (Route Origin Authorization) is well-established across every RIR. 'ASNs with a ROA' only means an ASN has signed at least one IPv4 or IPv6 resource — it doesn't mean everything that ASN announces is covered. A network with 1 of its 50 announced prefixes signed counts exactly the same as one with all 50 signed, if you only look at that column. The table also shows the actual object count — the total number of individually signed resources (VRPs) per RIR — and the average number of signed objects per covered ASN, which gives a sense of how deep the coverage actually goes, not just how many networks have started.

The chart above shows the ASN-presence metric only for visual consistency with the ASPA chart.

ROV — Is Anyone Actually Checking?

Publishing a ROA or ASPA only matters if other networks validate against it. ROV (Route Origin Validation) measures that missing piece — not what's published, but what's actually enforced. APNIC Labs runs a continuous global measurement of this using anycast beacon routes delivered to end-user devices via an ad-measurement network: one route is permanently RPKI-valid as a control, another is permanently RPKI-invalid, and APNIC tracks what fraction of a country's users can still reach the invalid one — those users are sitting behind networks that are not dropping invalid routes. (The exact prefixes used aren't publicly disclosed, deliberately — publishing them would let networks treat them a special one rather than genuinely enforcing ROV everywhere. Full methodology: APNIC Labs, "How we measure". Worth noting: independent researchers (in the TORCH paper, which cross-checked APNIC's results against their own multi-prefix measurement) have pointed out that relying on a single invalid test prefix gives only a partial view compared to testing many prefixes simultaneously — treat these numbers as a solid trend indicator rather than an exact figure.)

As of 2026-11-10, 31.59% of internet users globally sit behind networks enforcing ROV.

Where does India stand next to the countries doing this best? Here's the same 28-day filter rate, worldwide and then narrowed to Asia, both anchored on India so its position is easy to see either way:

Both lists are restricted to countries with roughly 10 million or more internet users, so small countries with unusually high (or low) numbers don't crowd out the comparison. This candidate list is a manually maintained estimate, not a live feed, and is only recalculated every 48 hours rather than on every refresh, since these rankings don't move much day to day.

The APNIC Region

Zooming into APNIC specifically — 624 ASNs out of 31,480 total APNIC-delegated ASNs (1.982%) currently publish an ASPA object.

Special Case: AS0

India

77 of India's 6,264 APNIC-delegated ASNs (1.229%) currently publish ASPA.

Progress Report — Who's Adopting, and When

The numbers above are a snapshot; this table is the timeline behind them. Every APNIC-region ASN gets logged here the first time it shows up publishing ASPA, with the date it was first observed - so instead of just knowing the current count, you can see who's actually been adopting it and when, not just India's ASNs but the whole APNIC region. Newest entries first.

Recently Removed ASPA

The flip side of the table above: ASNs that WERE publishing ASPA and no longer are. This usually means one of a few things — a network deliberately withdrew it, a CA transition or renewal briefly dropped it. Newest removals first. If an ASN adopts, is removed, and later re-adopts, each removal is logged as its own separate event here — nothing gets silently merged or overwritten.

For ROA, the picture is far more mature: 3,024 ASNs (48.276%) publish at least one ROA, covering 42,637 signed resources in total.

Why Bother With Any of This?

If you run a network, here's the plain case for turning these on:

• A ROA stops someone else from accidentally (or deliberately) claiming your IP addresses. Without one, any network in the world can announce your address range, and other networks have no way to tell that's wrong. It's happened by accident more times than anyone would like — a typo in a router config at some other company, and suddenly some of your traffic goes to them instead of you.
• An ASPA stops your traffic from getting rerouted through the wrong path. Even with ROAs everywhere, a network can still leak your route to the wrong upstream by mistake. An ASPA is you explicitly saying "these are my only legitimate upstream providers" — so a leak through anyone else gets caught immediately instead of silently working (badly).
• Turning on ROV means you actually get the benefit of everyone else's ROAs and ASPAs. Publishing your own ROA protects other people's networks from routing mistakes involving your prefixes. Turning on ROV protects your own network from other people's mistakes. You need both sides for any of this to actually work — a signature nobody checks doesn't stop anything.
• None of this requires trusting a single central authority blindly. You're not asking anyone to take your word for it — the whole point of the cryptographic signatures is that any network can verify it independently, automatically, without a phone call or a support ticket.
• It's a one-time setup, not an ongoing burden. Once a ROA, ASPA, or ROV filter is configured, it runs itself. The cost is mostly a few hours of setup and testing; the benefit is permanent protection against a whole category of routing mistakes that otherwise go undetected until something breaks.

Closing Thoughts

These numbers move slowly, and that's expected — ASPA only protects a network once that network actually publishes it, and that depends on how ready each RIR's tools are and whether individual network operators get around to setting it up. This post keeps refreshing on its own, so come back for the current numbers instead of trusting whatever you read here on any one day.

Data sources: rpki-client console output, APNIC/RIPE/ARIN/LACNIC/AFRINIC delegated statistics files, RDAP lookups against rdap.apnic.net. Auto-refreshed every 24 hours. Snapshot generated: 2026-11-11 17:08 IST.