BGP Route Hijack & RPKI Validator
Audit cryptographic Route Origin Authorizations (ROAs) and BGP route hygiene across the global Internet infrastructure. Protects authoritative DNS root letters (A through M), top-level domain registries, and tier-1 resolvers from malicious BGP route hijacks and accidental leaks.
Why RPKI Validation is Essential for DNS Security
The Border Gateway Protocol (BGP) originally lacked built-in authentication, allowing any Autonomous System (ASN) to falsely advertise IP space belonging to others. When bad actors announce more specific prefixes (/24 instead of /22), global Internet traffic can be hijacked, redirecting DNS queries to rogue resolvers to intercept credentials or forge records.
Resource Public Key Infrastructure (RPKI, RFC 6480) solves this vulnerability by issuing cryptographically signed Route Origin Authorizations (ROAs) via Regional Internet Registries (RIRs). Internet service providers executing BGP Origin Validation automatically discard invalid announcements, neutralizing hijack attempts before traffic is diverted.
| Target Service | Category | IP Prefix | Origin ASN | RIR | RPKI State | Max Len | ROA Expiry | Anycast Nodes | Route Protection Architecture |
|---|---|---|---|---|---|---|---|---|---|
| A-Root (Verisign) | Root DNS | 198.41.0.0/24 | AS26415 Verisign Global DNS | ARIN | Valid | /24 | 2026-12-31 | 48 | Cryptographically signed ROA + BGP Origin Validation at IXP edge |
| B-Root (USC-ISI) | Root DNS | 170.247.170.0/24 | AS394353 USC Information Sciences Institute | ARIN | Valid | /24 | 2027-06-15 | 6 | RPKI ROA active + Strict max-prefix filters |
| C-Root (Cogent) | Root DNS | 192.33.4.0/24 | AS2149 Cogent Communications | ARIN | Valid | /24 | 2026-09-30 | 28 | ROA verified across ARIN Trust Anchor Locator |
| D-Root (Univ. of Maryland) | Root DNS | 199.7.91.0/24 | AS10886 University of Maryland | ARIN | Valid | /24 | 2027-01-20 | 152 | Multi-party RPKI signing with PCH Anycast edge |
| E-Root (NASA Ames) | Root DNS | 192.203.230.0/24 | AS2153 NASA Ames Research Center | ARIN | Valid | /24 | 2026-11-15 | 120 | Strict ARIN ROA and automated prefix hijack alarming |
| F-Root (ISC) | Root DNS | 192.5.5.0/24 | AS3557 Internet Systems Consortium (ISC) | ARIN | Valid | /24 | 2027-03-10 | 310 | Dual-ASN ROA authorization + Cloudflare Magic Transit |
| G-Root (US DoD NIC) | Root DNS | 192.112.36.0/24 | AS5927 Defense Information Systems Agency | ARIN | Valid | /24 | 2027-12-31 | 18 | DoD PKI integrated with ARIN RPKI repository |
| H-Root (US Army DEVCOM) | Root DNS | 198.97.190.0/24 | AS1508 US Army DEVCOM Army Research Lab | ARIN | Valid | /24 | 2026-08-25 | 16 | DISA BGP route filtering + ARIN ROA |
| I-Root (Netnod) | Root DNS | 192.36.148.0/24 | AS8674 Netnod Internet Exchange | RIPE NCC | Valid | /24 | 2027-04-18 | 85 | RIPE NCC cryptographic ROA + BGP Anycast scrubbing |
| J-Root (Verisign) | Root DNS | 192.58.128.0/24 | AS26415 Verisign Global DNS | ARIN | Valid | /24 | 2026-12-31 | 195 | ROA validation + Verisign Atlas telemetry monitoring |
| K-Root (RIPE NCC) | Root DNS | 193.0.14.0/24 | AS25152 RIPE NCC Operations | RIPE NCC | Valid | /24 | 2027-05-12 | 110 | Direct RIPE NCC trust anchor validation + RPKI BGP drop-invalid |
| L-Root (ICANN) | Root DNS | 199.7.83.0/24 | AS20144 ICANN DNS Operations | ARIN | Valid | /24 | 2027-02-28 | 175 | ICANN DNS engineering RPKI monitoring + ARIN signed ROA |
| M-Root (WIDE Project) | Root DNS | 202.12.27.0/24 | AS7500 WIDE Project / JPRS | APNIC | Valid | /24 | 2026-10-31 | 35 | APNIC signed ROA + JPNAP and BBIX route origin checks |
| .com / .net Authoritative (Verisign) | TLD Registry | 192.5.6.0/24 | AS3661 Verisign Global Registry Services | ARIN | Valid | /24 | 2026-12-31 | 240 | Strict ROA enforcement + Tier-1 carrier route filters |
| .org Authoritative (Public Interest Registry) | TLD Registry | 199.19.56.0/24 | AS12041 Afilias / Identity Digital | ARIN | Valid | /24 | 2026-11-20 | 80 | RPKI ROA validated on ARIN & Identity Digital edge |
| .de Authoritative (DENIC) | TLD Registry | 81.91.164.0/24 | AS31529 DENIC eG | RIPE NCC | Valid | /24 | 2027-07-01 | 45 | RIPE NCC ROA + DE-CIX BGP route server filtering |
| .uk Authoritative (Nominet) | TLD Registry | 213.248.216.0/24 | AS15497 Nominet UK | RIPE NCC | Valid | /24 | 2027-03-31 | 60 | Nominet automated BGP security audit + RIPE ROA |
| .xyz Authoritative (CentralNic / Team Internet) | TLD Registry | 194.169.218.0/24 | AS47869 CentralNic Ltd | RIPE NCC | Valid | /24 | 2026-09-15 | 50 | CentralNic multi-cloud RPKI validation |
| Legacy Sovereign ccTLD Nameserver | TLD Registry | 196.216.144.0/22 | AS37153 African Regional Internet Registry | AFRINIC | NotFound | /22 | N/A | 2 | No signed ROA published (legacy BGP filtering only) |
| Cloudflare 1.1.1.1 | Public Resolver | 1.1.1.0/24 | AS13335 Cloudflare, Inc. | APNIC | Valid | /24 | 2027-08-30 | 330 | RPKI ROA validated globally + IsBGPSafeYet initiative |
| Google Public DNS 8.8.8.8 | Public Resolver | 8.8.8.0/24 | AS15169 Google LLC | ARIN | Valid | /24 | 2027-09-15 | 280 | Autonomous system ROA verification + automated peer resets |
| Quad9 9.9.9.9 | Public Resolver | 9.9.9.0/24 | AS19281 Quad9 Foundation (Switzerland) | RIPE NCC | Valid | /24 | 2027-04-01 | 220 | Swiss foundation RPKI enforcement + Global anycast scrubbing |
| Cisco OpenDNS 208.67.222.222 | Public Resolver | 208.67.222.0/24 | AS36692 Cisco Systems OpenDNS | ARIN | Valid | /24 | 2026-11-30 | 65 | ARIN verified ROA + Cisco Talos route anomaly intelligence |
Validation Mechanics & Trust Anchor Repositories
Route Origin Authorizations (ROAs) are validated against the five Regional Internet Registries (RIRs) serving as trust anchors: ARIN (North America), RIPE NCC (Europe & Central Asia), APNIC (Asia Pacific), LACNIC (Latin America & Caribbean), and AFRINIC (Africa). Each ROA specifies an authorized origin ASN, an IP prefix, and a maximum prefix length (MaxLength).
Routes with no valid certificate are classified as NotFound, leaving them vulnerable to accidental BGP leaks or deliberate prefix hijacking. All thirteen root server operators actively maintain Valid RPKI ROAs to guarantee untampered DNS root resolution worldwide.