On 15 October 2026, IPinfo published a measurement that deserves more attention than it got. The share of routed prefixes covered by a valid RPKI record rose from 54.0% in September 2025 to 70.3% in September 2026: sixteen points in a year, against three or four in each of the two years before it. More interesting than the growth is the evidence that filtering now bites. Across 1,614,288 routed prefixes, a typical valid route was seen by 596 of the BGP vantage points feeding RIPE RIS and RouteViews. A route with no RPKI record was seen by 595. An invalid route was seen by two.
Two. Enough networks now reject RPKI-invalid announcements that an invalid route goes nowhere. Which means the question facing anyone who runs infrastructure has quietly changed. It is no longer “is my address space signed”. It is “what exactly did I sign, and does that signature cover more ground than I intended”.
So we checked, against the same 100 Irish domains we have used for previous audits here.
TL;DR
- The signing is done. 313 of 319 prefix and origin-AS pairs serving these 100 Irish domains are RPKI-valid. Only six have no covering ROA at all.
- 47 of those 313 ROAs are non-minimal. Their maxLength is longer than the prefix actually announced, which authorises 22,746 more-specific prefixes that nobody announces. RFC 9319, a Best Current Practice since October 2022, says operators SHOULD NOT do this.
- The weak layer is DNS, not web. 92 of 99 domains have minimal ROAs on every address serving their website; only 66 of 99 can say the same about their nameservers.
- One non-minimal ROA covers the authoritative DNS for gov.ie, hse.ie, revenue.ie, welfare.ie and citizensinformation.ie, plus the HSE’s mail gateways and Dublin City Council’s website. A single forged-origin /24 would validate.
- 37 of the 47 never use the slack. No more-specific inside those ranges is announced by the legitimate AS, which is precisely the case RFC 9319 warns propagates widely.
- Globally the number has not moved in nine years. 13.2% of the 1,021,412 ROA payloads published today are non-minimal, against the 12% in June 2017 that RFC 9319 was written to address.
What we measured, and how
For each of 100 Irish domains spanning media, banking, retail, utilities, transport, government, universities, insurance and classifieds, we resolved the apex A record (falling back to the www host), the AAAA record, the MX hosts and their addresses, and the NS hosts and their addresses. That produced 697 unique IP addresses: 638 IPv4 and 59 IPv6.
Each address went to the RIPEstat network-info endpoint for its covering prefix and origin AS, giving 303 distinct prefixes across 78 autonomous systems. Each prefix and origin pair then went to RIPEstat’s rpki-validation endpoint, which runs Routinator against the live global ROA set and returns a status plus the ROAs that produced it. We recorded the maxLength of every validating ROA alongside the length of the prefix actually in the routing table.
For the global baseline we pulled the full validated ROA payload set from Cloudflare’s public rpki.json, built at 07:15 UTC on 16 October 2026, and counted non-minimal entries directly. Every figure below comes from data collected on 16 October 2026.
Finding 1: Irish infrastructure is signed, and that is genuinely good news
313 of 319 prefix and origin-AS pairs validate. That is 98.1%, well above the 70.3% global average for routed prefixes, which makes sense: this corpus is weighted towards banks, state bodies, large retailers and the hyperscale clouds that host them, all of whom did this work years ago.
Six pairs returned a status of unknown, meaning no ROA covers them at all. The most striking is vhi.ie, which serves its website from 193.104.136.0/24 announced by AS41973, registered to Vhi Healthcare itself: an organisation that went to the trouble of running its own autonomous system and never published a ROA for it. The others are unsigned ranges carrying DNS for localenterprise.ie and smythstoys.com and mail for dng.ie and sky.com.
If coverage were the whole story, this post would end here with a tidy result. It is not, because a ROA does not say “this prefix is protected”. It says “this AS may originate these prefixes”, and the word “these” is where the trouble lives.
Finding 2: 47 ROAs authorise address space nobody announces
A ROA names a prefix, an origin AS, and an optional maxLength. Set maxLength longer than the prefix and you have authorised that AS to originate every more-specific prefix down to that length. BGP prefers the most specific route, so an attacker who announces a more-specific prefix and forges the authorised AS into the path produces an announcement that is both preferred by every router and RPKI-valid. This is the forged-origin sub-prefix hijack, and RFC 9319 exists to tell operators how to shrink the window for it.
The language is not ambiguous. RFC 9319 is BCP 185: “In general, the ROA SHOULD NOT make use of the maxLength attribute unless doing so has no impact on the set of included prefixes.”
47 of the 313 valid pairs here, covering 34 distinct prefixes, do use it. Between them they authorise 22,746 more-specific prefixes beyond the 47 actually announced. Two of those ROAs belong to Vultr (AS20473), covering 136.244.64.0/18 and 95.179.128.0/17 at a maxLength of /32, which accounts for 16,380 of that total on its own. The rest cluster at /24, the smallest prefix most networks will accept and exactly the length an attacker would choose.
Finding 3: the soft layer is DNS
Split the same addresses by what they do for the domain and an asymmetry appears that no aggregate figure would show you.
| Layer | Domains measured | All ROAs minimal | At least one non-minimal | At least one with no ROA |
|---|---|---|---|---|
| Website (IPv4) | 99 | 92 | 6 | 1 |
| Website (IPv6) | 20 | 20 | 0 | 0 |
| Mail (MX hosts) | 93 | 86 | 5 | 2 |
| DNS (NS hosts) | 99 | 66 | 32 | 2 |
Websites are in good order: 92 of 99 clean. Nameservers are not: 32 of 99 domains have at least one authoritative nameserver sitting inside a prefix whose ROA authorises more-specifics that are never announced. Counting any layer, 37 of 99 domains carry at least one non-minimal or absent ROA somewhere in their dependency chain, and 62 are clean throughout.
The explanation is structural rather than careless. Websites sit behind Cloudflare, Fastly, Akamai, AWS and Azure, all of whom publish tight, minimal ROAs. Authoritative DNS is far more likely to be self-hosted or parked with a smaller provider, and that is where the loose records are.
The concentration is severe. 137.191.224.0/19, announced by AS15806 (registered to the Irish Government) with a maxLength of /24, contains the nameservers cwext.gn.gov.ie at 137.191.224.10 and gbext.gn.gov.ie at 137.191.224.140. Those two are authoritative for gov.ie, hse.ie, revenue.ie, welfare.ie and citizensinformation.ie. They are also both inside 137.191.224.0/24, so a single forged-origin announcement of that one /24 would capture both nameservers for all five services at once and pass origin validation on the way. The same /19 holds the HSE’s two inbound mail gateways and the website of Dublin City Council. The third nameserver in each of those delegations, ext3.gn.gov.ie, sits on AWS under a minimal ROA and would survive, which is a real mitigation but a thin one.
The pattern repeats elsewhere. Blacknight (AS39122) holds two loose ranges carrying the DNS for Dublin Bus, Bus Eireann, Flogas, Ibec, the SFA, Skillnet Ireland, Dublin Chamber and FBD. Vercara’s UltraDNS ranges carry Ryanair, Tesco Ireland and Permanent TSB. Asiera (AS1213), the Irish research and education network, publishes five /16 ROAs at maxLength /24 covering the nameservers of Trinity, UCD, Maynooth, UL and Galway.
Finding 4: 37 of the 47 never use the room they left
A non-minimal ROA is defensible if the operator genuinely announces more-specifics from it, for traffic engineering or DDoS mitigation, and RFC 9319 discusses exactly those cases. So we pulled the full announced-prefix list for every AS involved and checked whether any more-specific of each loose range is in the routing table from the legitimate origin.
Ten are. Thirty-seven are not, including every one of the Irish Government, Asiera, Blacknight, Vercara and Vultr ranges above. RFC 9319 is explicit about why the unused case is the dangerous one: a forged-origin hijack of a sub-prefix the legitimate AS does not announce “can propagate widely throughout the Internet”, whereas if the real AS were announcing it, the hijack competes against a shorter AS path and spreads less. Those 37 ROAs leave the best version of the attack available in exchange for flexibility nobody is using.
Finding 5: the global number has not moved since 2017
Cloudflare’s validated payload set on 16 October 2026 contains 1,021,412 entries. 135,172 of them, 13.2%, have a maxLength longer than the prefix: 13.8% of IPv4 payloads and 11.3% of IPv6, with LACNIC an outlier at 36.9% and the other four registries between 11.1% and 15.0%. 11,058 IPv4 payloads carry a maxLength of /32.
Now read RFC 9319 section 4, which cites the measurement the document was written in response to: “Network measurements taken in June 2017 showed that 12% of the IP prefixes authorized in ROAs have a maxLength value longer than their prefix length. Of these, the vast majority (84%) were non-minimal.”
Nine years, one IETF Best Current Practice and a tripling of RPKI adoption later, the figure is 13.2%. In our Irish sample, 37 of 47 is 79%, against the 84% of 2017. The share of operators getting this wrong is essentially unchanged; there are simply far more of them now, because the signing campaign worked and the configuration advice did not travel with it.
Why this connects to the certificate story
Earlier this month we looked at a set of country-code top-level domain hijacks in which attackers compromised registries, rewrote authoritative DNS, passed automated domain control validation and walked away with genuine HTTPS certificates. We found that zero of these same 100 Irish domains publish the account-bound CAA records Google asked for, and only five sign their DNS with DNSSEC.
A forged-origin sub-prefix hijack of a nameserver’s prefix reaches the same destination by a different road. Control the route to the authoritative nameserver and you control the answers it appears to give; domain control validation then becomes an ordinary check that you pass, and the certificate you receive is real. The two findings compound, because the domains with the loosest routing protection around their nameservers are largely the same ones with no CAA restriction and no DNSSEC to detect the forgery. Our earlier look at who actually chose your DNS resolver covers the other end of the same path.
And ourselves
We make a habit of running these audits against our own estate, so: the host we measured from sits in Hetzner’s 2a01:4f8::/32, whose ROA carries a maxLength of /48, authorising 65,536 more-specifics. Hetzner’s 78.46.0.0/15 and 65.21.0.0/16 are both non-minimal at /24 and carry Irish customers in the data above. We also fetched Cloudflare’s RPKI test beacons from that host: the invalid one returned HTTP 200, so our egress does not reject invalid routes either. We are describing a problem we are inside of.
What to actually do about it
None of this is a project. It is an afternoon.
- Compare each ROA’s maxLength to what you announce. If you announce a /19 and the ROA says /24, close it unless you can name the more-specific you rely on. One ROA per announced prefix is what RFC 9319 means by minimal, and extra ROAs are cheap where a wide maxLength is not.
- Check your nameservers’ prefixes, not just your website’s. This is the layer the data says people miss, and it is the layer that unlocks certificate issuance.
- Ask your DNS and mail providers. If your authoritative DNS is outsourced, their ROA hygiene is yours. The question is one line: what is the maxLength on the ROA covering your nameserver prefixes.
- Turn on route origin validation at your own edge. Signing stops others announcing your space; validating protects your users from everyone else’s mistakes.
REPTILEHAUS builds and runs infrastructure for clients who have no particular reason to know which of these layers they sit on, which is the normal state of affairs for a business that sells insurance or furniture. Mapping that chain, from registrar to ROA to resolver, is part of how we take a platform on. If you want to know which of the patterns above describes your own estate, get in touch.
Method and caveats
Resolution ran against 1.1.1.1 from a single vantage point in Germany, so geo-steered DNS may have returned different addresses than an Irish client would see; for anycast providers the prefix is identical regardless. an-post.ie returned no address records at the apex or on www, matching the CAA audit, so website figures are out of 99, and seven domains published no MX. We queried at most four MX hosts and six NS hosts per domain, and treated the eight multi-origin prefixes as valid if any announcing AS validated: the generous reading. The global baseline counts validated ROA payloads rather than prefixes or addresses, so it is not directly comparable to the 70.3% routed-prefix figure. Most importantly, a non-minimal ROA is not a vulnerability on its own. It widens the window for a forged-origin hijack that still has to be launched, accepted by an upstream and propagated. We measured the window, not an incident.
Photo by Denys Nevozhai on Unsplash
