Summary

  • At APNIC 62 in September 2026, Gaurav Kansal showed that valid ROAs covered 89% of India's announced IPv4 address span and 98% of its announced IPv6 span on 5 September. APNIC Labs' seven-day measurement put route-origin filtering near 1.2% on 4 September.
  • His account of conversations with operators identified the missing step: publishing a ROA takes a portal action; enforcing Route Origin Validation puts a validator and a new decision into a live network. NIXI's exchange validation was a stated plan for early 2027, not a completed deployment.

The scorecard looked ready for a victory lap. In the slides Gaurav Kansal took to APNIC 62, valid Route Origin Authorizations covered 89% of India's announced IPv4 address span and 98% of its announced IPv6 span on 5 September 2026. Then came the other number: APNIC Labs' seven-day measure of Route Origin Validation filtering was about 1.2% for India on 4 September. The paperwork had reached the network; the network had scarcely started reading it.

Kansal was presenting at the Routing Security SIG in Mumbai. The official programme identifies him as a Joint Director (IT) at India's National Informatics Centre; his talk speaks for work with NIXI and IRINN. His useful distinction was operational, not ceremonial. A ROA records which autonomous system may originate a route. A receiving network must run a validator and apply its answer to route selection before the record can stop an unauthorized origin at that network. A published signature is a tool waiting for a reader.

The denominator is part of the story. The 89% and 98% figures weight announced address space. Count announcements instead and Kansal's same slide gives 85.7% for IPv4 and 85.2% for IPv6. Large signed IPv6 blocks make an address-weighted chart look tidier than a route-count chart. Neither chart counts how many networks enforce the result. Kansal kept publication and validation on separate pages; the industry's applause often bundles them together.

Why leave a finished form unused? In the official session transcript, Kansal describes asking NIXI members. Signing through a portal required little change to production routers. Validation meant installing a relying-party validator, connecting it to the routing equipment, and deciding what to reject. Some operators hoped an upstream would filter first. Some worried that a wrong rejection would strand their customers while a rival's service still worked. These are the reasons he says members gave, rather than a survey of every Indian network.

Even the chart tried to pull a prank. Kansal's slide shows India's seven-day filtering series jumping to 41.5% on 11 August, then retreating toward 1.15%; the global series jumped on the same dates. He asked APNIC whether this was a collection artifact. The warning matters because a sudden improvement in a measurement is a lead to investigate, not a deployment certificate. The September figures are dated snapshots; APNIC Labs' live dashboard continues to change.

Kansal pointed to a lever and to its limits. Five large networks carry much of the country's traffic or serve smaller providers upstream. Getting them to validate could move the aggregate measure quickly. During questions, another speaker noted that even a single-homed operator can learn a bad route from a peer at an exchange. Kansal agreed. A national percentage may rise when the big operators act; a smaller operator still owns its own routing decisions.

His APNIC-hosted deck described a delegated RPKI test bed under APNIC, explicitly short of production, and a goal to enable ROV and ASPA validation on NIXI's BIRD exchange route servers by the end of the first quarter of 2027. APNIC and NIXI also announced a partnership focused in part on helping operators deploy validation. Those are useful promises precisely because the gap is visible. The next headline should come from a router accepting or rejecting a route, not from one more signature appearing on a chart.