Summary

  • ARIN reported 9,673 organizations registered for RPKI on 30 September 2026, up 27% in a year; its separate Hosted RPKI count put roughly 1,195 organizations at zero ROAs.
  • A resource certificate and an account in the service do not publish a decision about which ASN may originate a prefix. The holder must create that ROA, and the resulting route still has to be observed and validated.
  • ARIN’s presentation also put 94% of allocated IPv4 blocks within RPKI eligibility and 59.4% of announced ARIN-registered IPv4 blocks in the RPKI Valid state. Those percentages describe different populations.

A registry can count a sign-up before an operator has made a routing assertion. ARIN’s Routing Security Update at ARIN 58 placed that distinction in unusually plain view. The Q3 2026 bar showed 9,673 organizations registered for RPKI, compared with 7,612 a year earlier. Across the same slide, approximately one in seven organizations on Hosted RPKI had not created a single Route Origin Authorization. The chart printed about 8,300 Hosted organizations with ROAs and about 1,195 without them. Its data were current to 30 September.

The two halves of the slide are tempting to combine into one neat percentage. They do not form one neat population. ARIN’s registration headline covers RPKI organizations; the “one in seven” statement identifies Hosted organizations. ARIN also offers delegated operation and a repository-publication service. The approximate Hosted figures on the slide do not sum to 9,673. A claim that “12.4% of all ARIN RPKI members have no ROA” would be tidy, memorable and unsupported. The less decorative reading is sharper: ARIN knows its participation number is not an authorization number, and it showed the missing authorizations on the same page.

The distinction begins with the object being counted. ARIN’s ROA guide defines a ROA as a signed statement that an Autonomous System Number may originate a specified IP prefix. An operator chooses the origin AS, the prefix and the maximum permitted length. Those fields are not onboarding paperwork. A wrong maxLength can change how more-specific announcements are classified; ARIN’s best-practices guide gives the simple example of a /16 authorization alongside announced /24s. The /24s can be Invalid if the authorization does not cover them. The decision needs the routing table, not just an account badge.

Hosted RPKI removes much of the cryptographic and publication machinery from the customer’s desk. ARIN runs the certificate authority and repository. The deployment options describe the other routes: a holder can operate its own delegated certificate authority and repository or use ARIN’s publication service with cryptographic control retained. In the Hosted case, however, ARIN’s automation cannot guess the resource holder’s intended origin ASN and prefix policy. Someone with authority over the resources must make the statement. A blank ROA list is a separate operational state, not a small-font footnote to successful enrollment.

That is why the numbers matter to leadership rather than only to a routing engineer. A board packet can say RPKI registrations rose 27%, and the sentence is true. A routing-security plan cannot stop there. The holder’s registry eligibility, service registration, first ROA, published repository object, validator result and route acceptance are separate receipts. The slide supplies the first and exposes a gap at the third. It does not publish a route-by-route chain for the roughly 1,195 Hosted organizations.

ARIN’s second chart reinforces the danger of letting attractive percentages slide across denominators. It says 94% of ARIN-allocated IPv4 blocks are eligible for RPKI because they are covered by an ARIN agreement. It says 59.4% of ARIN-registered IPv4 blocks in Internet announcements are RPKI Valid. Eligibility is measured against allocated blocks; validity is measured against blocks appearing in announcements. Subtracting the latter from the former would invent an address-space deficit from two different bases. The chart’s 1,646 million allocated IPv4 addresses, 1,548 million under agreement and 920 million RPKI Valid make the progression visible, but they are labels for distinct stages, not three buckets of organizations.

The slide does not list why the zero-ROA Hosted organizations have made no assertion, how long they have been in that state, or which of them announce routes. Those records would show whether the gap is a stalled deployment, a deliberate choice, or accounts with nothing to authorize. For now the decision point is clear enough: a service can be widely adopted on paper while its central signed object is absent for a measurable group of users.

ARIN itself put the operational sentence on the slide. Registration and route protection are different events. Its meeting record names the presentation and its speaker, Brad Gorman, Director of Customer Technical Services. The evidence is an institutional self-report, not a rival vendor’s market estimate. An operator can test the public side of the claim by looking for the intended ROA in the repository and the route’s validator result. A director can ask for those receipts before accepting a rising registration line as progress. The portal may have opened the door; the route still needs an authorization.