Summary

  • ARIN reported 9,673 organizations registered for RPKI by 30 September 2026, up 27% in a year; roughly one in seven Hosted RPKI organizations still had no ROA.
  • Registration is the service doorway. A ROA is the signed statement that names an origin ASN, a prefix and its maximum length; route coverage and validation sit further down the chain.

The account is not the authorization

The dashboard can say “registered” before the Internet has received a single instruction about which network may originate which prefix. That is the awkward little gap inside ARIN’s good growth number.

At ARIN 58, the registry reported 9,673 RPKI organizations as of 30 September, a 27% increase over the year. Then came the sentence that should travel with the headline: roughly one in seven organizations using Hosted RPKI had not created even one Route Origin Authorization. The registration counter is moving. A meaningful slice of the Hosted cohort has not yet reached the action that gives RPKI something to say about a route.

The count has climbed steadily. ARIN’s 2025 Annual Report recorded 8,140 organizations signed up by 31 December 2025; 98% used Hosted RPKI. The report listed 1,839 new registrations during 2025, the largest annual total in its 2021–25 series. At ARIN 57 in April 2026, the registry reported 8,403 organizations and said about 15% of registered organizations had no ROA. By September, the headline count was 9,673.

That is brisk account growth. It is not yet a measure of how many resource blocks have an authorization that matches the way they are announced. The April and October summaries also describe the no-ROA group with different denominator language: “registered organizations” in one, “Hosted RPKI organizations” in the other. The published summaries do not give the numerator and denominator behind the October fraction. A precise count cannot be recovered from “roughly one in seven,” and the two snapshots do not establish that the share fell.

What a ROA actually asks the network to trust

RPKI begins with a resource certificate. In ARIN’s Hosted model, ARIN operates the certificate authority and the participant supplies routing information through ARIN Online. The ROA names three things: an origin Autonomous System Number, an IP prefix and a maximum prefix length. It says that the named ASN is authorized to originate that address space within those bounds.

That is a different job from registering for the service. Signup gets an organization to the dashboard and requests a certificate. The operator still has to identify the prefixes it controls, choose the origin ASN or ASNs, set the maximum length, review the result and submit the ROA. ARIN’s repository is published every five minutes. ARIN says operators should allow about 30 to 60 minutes for a newly generated ROA to affect routing decisions across the rest of the system.

Hosted RPKI removes a large operational chore: ARIN runs the certificate authority and repository. It does not choose the operator’s route origins. That last decision belongs with the network that knows which ASN should announce which prefix. A Hosted account without a ROA is therefore a service enrollment with no route-origin statement attached to it.

The distinction matters because route validation happens downstream. A relying party retrieves and validates the repository. A network operator can use that validated information when deciding how its routers should treat an announcement. The public system acts on the signed objects it receives, not on the number of dashboard accounts ARIN has opened.

The denominator has a shape

“One in seven” is a useful warning, but it hides several operational questions. How many addresses sit behind those accounts? How many of their prefixes are announced? How many resources are not directly held by the organization at all?

ARIN’s own eligibility rules make those questions practical rather than academic. Its Hosted service is for direct resource holders. Reassigned or reallocated resources cannot simply be added to a downstream organization’s certificate; the upstream provider must submit the ROA on that organization’s behalf. A count of organizations cannot tell readers whether a no-ROA account controls a routed block, holds unused space, or depends on a provider for the relevant authorization.

ARIN already publishes more useful measures beside its registration count. Its April 2026 update reported that ROAs covered 50% of RPKI-eligible IPv4 blocks in the ARIN region, while 54% of ARIN-registered IPv4 blocks visible in Internet announcements were RPKI Valid. Those percentages answer different questions, and the gap between them is precisely why one headline number cannot stand in for adoption. One measures coverage among eligible resources; the other measures validation among observed announcements.

The dashboard is easy to promote because it gives the organization a clean, countable first step. The harder dashboard would follow each step after signup: certificate issued, first ROA created, eligible prefix covered, announced prefix validated. Each stage has a denominator. Each denominator tells a different story about where the work stops.

Adoption lives after the welcome screen

ARIN’s FAQ calls RPKI an opt-in service. It also says that a growing number of service providers require customers to create ROAs before a business agreement is finalized. That leaves the participant with a choice, but not always with a consequence-free one. A network may postpone the work while no immediate contract requires it; another may discover that an upstream or customer expects a specific authorization before traffic is accepted.

The first ROA is not the whole job. Prefixes change, resources move, networks add origins, and transfers can remove resources and associated ROAs from the old holder’s certificate. ARIN says its Hosted resource certificates renew automatically, and its ROAs auto-renew every 90 days. Automation keeps an existing authorization from expiring on schedule; it cannot guess that a new prefix should be authorized or that a route’s intended origin has changed.

This is why the strongest adoption measure is not the account count alone. It is the share of eligible, announced resources whose current ROAs match the operator’s intended origin and prefix length. The number should be accompanied by the denominator, the observation date and the treatment of downstream assignments. Without those, “adoption” is a welcome mat measured in footsteps, not evidence that the room is occupied.

ARIN has built the easy part well enough to attract nearly ten thousand organizations. The public record now points to the next product question: how many of those signups complete the first authorization, and how much of the announced address space does that authorization actually cover? The answer would turn a registration milestone into an operational measure—and give the next RPKI update a more useful number to celebrate.

Primary records: ARIN 58 Day 2 recap · ARIN 57 Day 2 recap · ARIN 2025 Annual Report · ARIN Hosted RPKI guide · ARIN ROA guide · ARIN RPKI FAQ · ARIN RPKI information.