Small RPKI servers secure 3,778 prefixes beyond RIRs

The internet’s routing security relies on a patchwork of small, independently operated RPKI publication servers that collectively secure thousands of IP prefixes outside the five Regional Internet Registries (RIRs). New research from SIDN Labs quantifies this long tail of infrastructure, showing how cloud providers, ISPs, and even hobbyists contribute to BGP security while introducing new risks through configuration choices.

Who runs the small servers

The study defines "small" RPKI servers as those publishing fewer than 1,300 Route Origin Authorisations (ROAs). This threshold emerged from analyzing the distribution of ROA counts across all known servers, where the five RIRs and Amazon Web Services dominate the majority of objects. The remaining 2,467 servers—operated by entities ranging from RPKI-as-a-Service (RPKIaaS) providers to academic institutions—were examined for their role in the global RPKI dataset.

Data collected in April 2026 revealed these small servers published 3,778 ROAs covering 3,778 prefixes across 1,163 unique Autonomous Systems (ASes). While the aggregate IP space represents just 0.016% of all IPv4 addresses, it includes critical services like government domains. The servers’ motivations vary: RPKIaaS providers offer unified APIs for cross-RIR management, while educational institutions use open-source tools like NLnet Labs’ Krill for research or training. Some operators cited operational control or personal interest as reasons for running independent infrastructure.

Validation and vulnerabilities

The dataset showed 91% of ROAs from small servers were cryptographically valid, with 91% of those matching active BGP announcements. However, 7.6% of objects failed validation entirely, and 1.2% were invalid. A more pressing concern emerged around the use of the maxLength parameter: 53.98% of ROAs set maxLength lower than the prefix length, authorizing more specific announcements than intended. While 80% of these cases had corresponding BGP coverage, 19.6% did not—leaving prefixes potentially vulnerable to sub-prefix hijacks.

The study highlighted specific outliers. One server, repo.rpki.space, had 8 of its 79 prefixes flagged on Firehol’s blocklist, suggesting ties to spam infrastructure. Another, ca.nat.moe, had all 99 of its ROAs fail validation, though the prefixes remained BGP-reachable. The largest server in the dataset, r.magellan.ipxo.com, published 776 IPv4 prefixes, all BGP-reachable but with 103 at risk due to broad maxLength settings.

Why it matters

The findings underscore the trade-offs of decentralized RPKI infrastructure. Independent servers reduce reliance on RIRs for organizations with multi-registry allocations or strict security requirements, but they also introduce configuration risks. The prevalence of maxLength misuse—contrary to RFC 9319 recommendations—poses a measurable, if limited, threat to routing security. Operators could mitigate this by creating separate ROAs for each prefix, though this would increase management overhead.

The study also noted the near-total absence of BGPsec deployment, a complementary standard that validates the entire AS path. While BGPsec adoption remains negligible across the industry, its lack of use in this dataset reflects broader challenges in routing security beyond RPKI.