Summary

  • ARIN counted 9,673 organizations registered for RPKI by 30 September 2026, up 27% in a year.
  • Roughly one in seven Hosted RPKI organizations had created no Route Origin Authorization; the presentation shows about 1,195 with none and about 8,300 with ROAs.

Buying the safety switch is one step. Turning it on is another. In the routing-security slides posted for ARIN 58, ARIN reports 9,673 organizations registered for RPKI at the end of September, 27% more than a year earlier. In the Hosted RPKI group, however, roughly one in seven has yet to create a single ROA. The chart labels about 1,195 with none and about 8,300 with ROAs.

Those numbers describe related but different populations: 9,673 is the registration total, while the ROA split is explicitly about Hosted organizations and its figures are approximate. ARIN’s own wording supplies the point: registration is not the same as protected routing. A ROA is the holder’s statement of which origin AS is intended for a prefix; without that statement, an account on the registry’s service dashboard has not done that job.

Another pair of ARIN figures shows why one headline percentage cannot settle the issue. The deck says 94% of ARIN-allocated IPv4 blocks are eligible for RPKI because they are under an ARIN agreement. It separately says 59.4% of ARIN-registered IPv4 blocks visible in Internet announcements are RPKI Valid. Eligibility counts allocated blocks under agreement; validity counts announced blocks meeting a routing-security test. They are distinct denominators, not two ends of one subtraction.

ARIN describes a planned “BGP Insight” view that would show prefixes in the global BGP table, explain Invalid and Not Found states, show possible impact and preview paths to Valid using its last BGP data pull. The posted deck places that view among new releases and upcoming development. The existing gap is already measurable; the usefulness of a new screen will be judged by what holders actually change.