Awal Haolader contributed to this work.
During the APNIC Routing Security Special Interest Group (SIG) at APRICOT 2025, I investigated RPKI across the Asia Pacific region, focusing on recent statistics, year-on-year changes, and what the data suggests for operators. This post will summarize those findings.
Global milestone
Globally, Route Origin Authorization (ROA) coverage (Figure 1) has cleared the 50% milestone with valid routes now at 60.3%, not‑found at 37.7%, and invalids at 2.0% — an increase of roughly six percentage points since February 2025. Regional snapshots show RIPE NCC leading, while LACNIC also maintains strong coverage.
For IPv6 (Figure 2), the global distribution is similar: 60.9% valid, 36.1% not‑found, and 3.0% invalid, with a gain of about seven percentage points in valid coverage since February 2025. ARIN and RIPE NCC remain the strongest performers in IPv6 ROAs.
Asia Pacific snapshot
Across the APNIC service region, IPv4 ROA coverage stands at 55.5% valid, 43.9% not‑found, and 0.6% invalid. Notably, South East Asia has surged to 92.4% valid (up ~12 percentage points year-on-year), South Asia sits at 89.9%, Oceania at 73.6%, and East Asia lags at 31.0%.
| Region / RIR | Valid | Not found | Invalid | Change in valid ROAs |
| Oceania | 73.6% | 26.3% | 0.2% | Up by ~3% |
| East Asia | 31.0% | 68.4% | 0.6% | Up by ~2% |
| South Asia | 89.9% | 9.8% | 0.3% | Up by ~1% |
| South East Asia | 92.4% | 7.2% | 0.4% | Up by ~12% |
| Region / RIR | Valid | Not found | Invalid | Change in valid ROAs |
| Oceania | 97.1% | 2.8% | 0.1% | Unchanged |
| East Asia | 21.9% | 78.1% | 0.0% | Down by ~5% |
| South Asia | 96.6% | 2.2% | 1.2% | Unchanged |
| South East Asia | 78.7% | 21.1% | 0.2% | Up by ~5% |
In the Asia Pacific, Oceania, and South Asia, IPv6 coverage is near full at 97.1% and 96.6%, respectively. South East Asia shows solid momentum at 78.7% (up ~5 points), whereas East Asia trails at 21.9% and has declined by ~5 points since February 2025.
Within East Asia, adoption is highly mixed. Some economies are approaching universal coverage, such as Mongolia, Taiwan, and Macao, while others, like China and South Korea, remain low, driving the subregional average down. The contrast underscores where outreach and tooling can have an outsized impact. With commitments from CNNIC and KISA, to improve routing security, we expect these numbers to improve in the near future.
What the invalids tell us
At the global level, the total number of invalids for IPv4 (Figure 3) has risen compared with 2025. However, the dominant cause has shifted. Last year, most invalids resulted from maxLength errors, whereas this year, Autonomous System Number (ASN) mismatches led. For IPv6, total invalids have decreased (from roughly 12,000 to 8,000), with maxLength issues still the most common problem category.
The Asia Pacific mirrors these global patterns (Figure 4). In the region, IPv4 invalids last year were largely maxLength-driven. This year, invalid origin-AS dominates, with the overall invalid share remaining small. Asia Pacific IPv6 invalids are significantly fewer overall than last year. These shifts suggest configuration hygiene is improving in one dimension (lengths) but needs continued attention for origin-AS accuracy.
Top performers
Looking at IPv4 ROA coverage within the Asia Pacific, small and island economies feature prominently at the top, reflecting how limited prefix counts can enable rapid progress to near-complete coverage. The IPv6 leaderboard (Figure 6) shows a similar pattern, with many economies close to 100% ROA coverage. These ‘long‑tail’ successes indicate that targeted engagements can help smaller networks reach full validation quickly.
ROV remains the bottleneck
Creating ROAs is necessary, but dropping invalids with ROV is what hardens the routing system. Globally, ROV deployment remains far behind ROA adoption: 26.6% of vantage points (per APNIC Labs methodology) support ROV, compared with much higher ROA coverage. Regionally, ARIN is the strongest (61.3%), followed by RIPE (35.3%), while APNIC is at 13.2%. This gap is the key opportunity area for the coming year.
In the Asia Pacific’s top‑20 ROV economies (Figure 7), Myanmar, Taiwan, Sri Lanka, and Tonga lead, with Myanmar particularly notable. The spread illustrates that once a few major transit operators switch on filtering, an economy’s measured ROV rate can climb rapidly.
South East Asia continues to be a bright spot. Viet Nam remains at the front for IPv4 ROA coverage (98.5%), while several neighbours, including the Philippines, Lao PDR, Malaysia, Myanmar, and Cambodia, are in the 90%+ range. The standout story is Indonesia, which jumped from just over 60% IPv4 ROA coverage last year to 90.6% by late 2025, with a sharp rise between July and December. Indonesia’s IPv6 ROA coverage is now 80.8%.
Indonesia’s ROV has begun to follow, currently a little over 22%, while Myanmar leads the subregion at 65%. The divergence between ROA creation and ROV filtering highlights the operational work that remains.
Why the gaps persist
The data reveals a consistent global pattern: ROA adoption is outpacing ROV deployment. Operators tend to create ROAs first because the risk is low, the benefits are clear, and the tooling is well established. By contrast, ROV is often deferred due to concerns about traffic drops, incomplete validation within customer cones, legacy provisioning systems, and the risk of unintentionally filtering legitimate route announcements.
The shift in invalid routes, from maxLength errors to origin-AS mismatches, also indicates a need to strengthen documentation and automation around authoritative origin management. This includes better alignment between customer-facing ROAs and provisioning workflows, along with improved IRR and RPKI consistency checks. In the Asia Pacific, the trendlines suggest that focused support on ROA accuracy and carefully staged ROV rollouts would deliver the most significant short-term security gains.
Practical guidance for operators
Based on the trends presented:
- Close the loop from ROA to ROV: If you are at or near full ROA coverage, plan a phased ROV deployment (monitor‑only → partial block → full). Start with peer/transit relationships where both sides have strong ROA hygiene.
- Eliminate origin-AS mistakes: The dominant invalid category in the Asia Pacific is now AS mismatch. Ensure internal provisioning, IRR objects, and ROAs share a single source of truth for origin-AS. Automate checks at change times.
- Use maxLength carefully: While max-length errors have declined, they still occur —often during traffic engineering. Follow the minimal ROA principle: Only include a maxLength when operationally necessary, keep it as tight as possible, and review ROAs after network changes.
- Leverage community examples: Economies with near‑universal coverage (many in South Asia, Oceania, and South East Asia) show what is achievable. Reuse their playbooks — from registrar workflows to default templates for customers.
- Measure what matters: Track not only ROA coverage, but also invalid‑drop effectiveness and time‑to‑fix for misconfigurations. Use public telemetry to cross‑check your stance against regional and global baselines.
Watch Shane’s APRICOT 2026 presentation in full:
The views expressed by the authors of this blog are their own and do not necessarily reflect the views of APNIC. Please note a Code of Conduct applies to this blog.