BGP Security in 2026: Why the Internet Still Routes on Trust, and What RPKI Actually Fixes
- Internet Pros Team
- September 10, 2026
- Networking & Security
Almost everything on the modern internet is authenticated. Web sessions are encrypted, email is signed, software is verified against a supply chain of attestations. Underneath all of it sits the protocol that decides where the packets physically go, and until recently that protocol asked no questions at all. Border Gateway Protocol works because roughly seventy five thousand independent networks agree to believe each other. When one of them says something untrue, whether by malice or by a typo at three in the morning, large parts of the internet quietly follow.
The Protocol That Runs on Good Faith
BGP is the announcement system of the internet. Every network with its own address space, identified by an autonomous system number, tells its neighbours which blocks of IP addresses it can reach. Those neighbours pass the announcement along, adding themselves to the path. Within minutes a route propagates worldwide, and traffic starts flowing down it.
There is no built in verification anywhere in that sequence. A router accepting an announcement has no cryptographic way to ask whether the sender is entitled to speak for those addresses. It applies local policy, prefers the shortest and most specific path on offer, and forwards packets accordingly. The design scaled the internet from a few hundred networks to a global system, but the trust model is closer to a rumour than a ledger.
The consequences are not theoretical. Traffic for payment processors, government departments and cloud providers has been diverted this way, sometimes for hours. In most incidents the cause was operator error rather than an attack, which is not the reassurance it sounds like. If a mistyped configuration can pull traffic across the planet, so can a deliberate one.
Three Ways Routing Goes Wrong
These failures get lumped together as hijacking, but they behave differently and need different controls.
| Failure | What happens | Typical cause | Does RPKI stop it |
|---|---|---|---|
| Prefix hijack | A network announces address space it does not hold | Fat finger, or deliberate interception | Yes, when the real holder has published a ROA |
| Subprefix hijack | A smaller, more specific block is announced and wins on specificity | Targeted interception | Yes, if the ROA sets a sensible max length |
| Route leak | Routes learned from one provider are re-advertised to another | Missing or broken export filters | No, the origin is entirely legitimate |
| Path forgery | The AS path is fabricated to look shorter or to end at the true origin | Sophisticated attacker | No, RPKI validates origin only |
Encryption protects the contents of the conversation. It does nothing about who the conversation was handed to on the way, and a hijacked route is a permanent, silent copy of every packet that took it.
What RPKI Actually Does
Resource Public Key Infrastructure attaches cryptography to address ownership. The five regional internet registries, the bodies that allocate address space in the first place, act as trust anchors. A network that holds a block of addresses publishes a Route Origin Authorization: a signed statement saying which autonomous system is permitted to originate that block, and how specific the announcements are allowed to be.
Other networks run validator software that fetches every published ROA, checks the signatures, and hands their routers a list of valid origin pairings. Incoming announcements are then classified as valid, invalid or not found. The critical step is what happens next, and it is where most of the deployment gap lives. Publishing a ROA protects nobody by itself. The protection comes from other networks choosing to drop announcements marked invalid, which is called Route Origin Validation.
That distinction matters when reading adoption statistics. A large share of announced address space is now covered by ROAs, which sounds close to solved. What actually determines whether a hijack propagates is how many transit providers and exchange points enforce validation, and that figure is meaningfully lower. Coverage is a prerequisite. Enforcement is the control.
What It Does Not Do
RPKI verifies one thing: that the network at the end of the path is allowed to announce the prefix. Everything else in the announcement remains unverified. An attacker who appends the legitimate origin to a fabricated path produces something RPKI marks valid, because the origin genuinely is valid.
Route leaks sit outside its scope entirely. When a provider accidentally re-advertises its full transit table to a second provider, every announcement in that flood has a correct origin. The routes are real, the relationship is wrong, and RPKI has no concept of relationships. This is what ASPA, Autonomous System Provider Authorization, is designed to address, by letting a network publish which providers may carry its routes upstream. It is still in standardisation and early deployment.
BGPsec, which signs the entire path, has existed as a specification for years and is deployed almost nowhere. The cost per announcement and the need for near universal adoption before any benefit appears have kept it academic. The realistic path is incremental: origin validation now, provider authorization next, full path validation eventually if at all.
Five Questions Worth Asking Your Provider
- Do you drop RPKI invalid routes? Not whether they support RPKI. Whether invalid announcements are actually discarded at the edge.
- Are you a MANRS participant? It is a voluntary programme, but it signals filtering, anti spoofing and coordination practices are in place.
- Do you filter customer announcements? Prefix filters and maximum prefix limits are what stop a customer mistake becoming a global one.
- Who publishes ROAs for our address space? If the business holds its own allocation, somebody has to maintain those objects and keep them accurate.
- How would we find out? Ask what monitoring exists and who receives the alert when a prefix appears from an unexpected origin.
What This Means for an Ordinary Business
Most organisations do not run BGP. They buy connectivity, and their exposure is inherited from whoever they buy it from. That makes routing security a procurement question rather than an engineering one, and it is rarely on the list.
- Make it a selection criterion. Two providers quoting similar prices are not equivalent if one enforces validation and the other does not. Put the question in the tender.
- Publish ROAs if you hold address space. Organisations with their own allocation, common among those who multihome, need ROAs with a max length that matches how they actually announce. A permissive max length reopens the subprefix hole.
- Watch your own prefixes. Free monitoring services built on public route collectors will alert on unexpected origins. Configuring one takes an afternoon and closes the detection gap.
- Keep TLS and DNSSEC hygiene tight. A hijack that redirects traffic still has to defeat TLS to read it, so strong certificate practice turns an interception into an outage, which is a much better outcome.
- Plan for the outage version. The most likely consequence of a routing incident is that your traffic goes nowhere for twenty minutes. Diverse connectivity is the answer, and it is worth pricing before it is needed.
The Direction of Travel
Regulatory interest has grown. Telecommunications regulators in several jurisdictions now ask major carriers to document their routing security practices and report on progress, and government procurement rules increasingly name RPKI directly. The pattern resembles email authentication a decade ago: voluntary, then expected, then effectively mandatory for anyone selling to large institutions.
None of this makes routing trustworthy the way a certificate chain is trustworthy. It makes the easiest and most common failures stop working, which is what security progress usually looks like. The internet will keep running on agreements between strangers. The useful change is that a growing number of those strangers now check the paperwork before believing what they are told.
