RPKI Route Validator
Route origin validation (RFC 6811) against our copy of the validated ROA payloads from the five RIRs' trust anchors.
The Resource Public Key Infrastructure lets the holder of an IP block publish a signed Route Origin Authorisation (ROA): a statement that a given AS may originate the block, up to a maximum prefix length. Networks that perform route origin validation use these to reject routes that contradict them.
Route origin validation (RFC 6811) has three outcomes. A route is valid when a ROA covers the prefix, names its origin AS and allows its length. It is invalid when ROAs cover the prefix but none matches: either a different AS originates it, or it is more specific than the max length allows. It is not found when no ROA covers it, so RPKI says nothing about it.
We validate against our own copy of the validated ROA payloads, built from the five RIRs’ trust anchors by the rpki-client project and refreshed every few hours. Leave the AS field empty to validate the origin our BGP table currently sees.
Frequently asked questions
My route is invalid. What now?
Usually the ROA is out of date: the prefix moved to another AS, or a more-specific was announced without raising the max length. The holder of the address block can fix it in their RIR's RPKI portal (RIPE NCC's for most Finnish networks).
Does 'not found' mean something is wrong?
No. It means the holder has not created ROAs. The route is accepted as before; it simply is not protected.
What is an AS0 ROA?
A ROA naming AS 0 states that no one should originate the prefix. Routes it covers become invalid unless another ROA validates them.