RPKI Protects 70.3% of Internet Routes After China Surge, Yet 18M Prefixes Remain Exposed

The share of routed internet prefixes protected by valid Resource Public Key Infrastructure (RPKI) records rose from 54.0% in September 2025 to 70.3% in September 2026, a gain of 16.4 percentage points. China drove almost 60% of the global address gain, increasing its share of IPv4 addresses in RPKI-valid routes from 3.7% in September 2025 to 83.0% a year later, while nearly 60% of remaining unprotected routed IPv4 space sits in the United States. Typical RPKI-valid prefixes and unsigned prefixes reach 596 and 595 public collector routers respectively, whereas invalid announcements are dropped by enough networks that a typical invalid prefix reaches just 2 vantage points. Despite rising adoption, 138,698 of 855,217 RPKI-covered IPv4 routes (16.2%) and 20.9% of covered IPv6 routes have Route Origin Authorizations (ROAs) looser than the announced route, leaving roughly 18M more-specific prefixes vulnerable to forged-origin hijacks that still pass RPKI validation. Autonomous System Provider Authorization (ASPA) deployment grew 25-fold from 131 networks on September 28, 2025 to 3,272 networks on September 28, 2026, with published records actively verifying about 3.5% of observed internet routing beyond automatic short-path checks.