DNS Checker.eu

RPKI Route Origin Validator

RPKI route origin validation for any AS and prefix pair: get valid, invalid_asn, invalid_length or unknown, the covering ROAs and their maxLength, and which ASes announce the prefix today.

e.g. - DNA DNA Oyj (FI)

About RPKI Route Origin Validator

The RPKI Route Origin Validator takes an origin AS number and a prefix and tells you what the global routing system makes of that pair. You get one of four verdicts - valid, invalid_asn, invalid_length or unknown - each with a plain sentence about what networks that enforce RPKI will do with the route, the covering ROAs and the maxLength they permit, and the list of ASes currently announcing the prefix in BGP. That is enough to decide whether an announcement will be accepted or dropped before you make it.

A Route Origin Authorisation, defined in RFC 6482, is a signed object in which the holder of an address block states which AS may originate it and how specific the announcement may be, via maxLength. RFC 6811 turns that into three BGP states: Valid, Invalid and NotFound. Two failure modes matter. invalid_asn means a ROA exists but names a different AS, which is exactly how a hijack presents itself, and also what happens when a ROA is not updated after a transfer. invalid_length means the announcement is more specific than maxLength allows, the classic self-inflicted outage after deaggregating a block.

This implementation reports the RFC 6811 NotFound state as unknown, and splits Invalid into invalid_asn and invalid_length so the cause is visible without reading the ROA yourself. Two lookups run in parallel from our EU infrastructure: the validation itself, and a routing-table view listing every AS seen originating the prefix, with holder names. Unknown deserves attention rather than relief - no ROA covers the prefix, so the route is accepted everywhere but unprotected, and anyone announcing that space would validate exactly as well as you do.

How to use it

  1. 1Enter the origin AS number in the first field; AS8309 and 8309 are both accepted.
  2. 2Enter the prefix in CIDR notation in the second field, for example 193.0.6.0/24 - a prefix length is required.
  3. 3Select Validate route origin to run the check from our EU servers.
  4. 4Read the status badge and the sentence beneath it: valid, invalid_asn, invalid_length or unknown, and what enforcing networks do with the route.
  5. 5Check the Covering ROAs panel to see which AS each ROA authorises and up to what maxLength.
  6. 6Compare that with the Currently announced by panel, which lists the ASes originating the prefix in BGP right now.

Common use cases

  • -Confirming a ROA is published and valid before you start announcing a prefix from a different AS.
  • -Investigating a suspected hijack, where the announcing AS returns invalid_asn against the covering ROA.
  • -Troubleshooting a prefix that became unreachable from RPKI-enforcing networks after you deaggregated it past its maxLength.
  • -Auditing your own address space for prefixes still returning unknown, meaning no ROA protects them.
  • -Verifying a customer's or peer's announcement against RPKI before you accept it into your routing policy.

Frequently asked questions

What does RPKI invalid mean?
It means a ROA covers the prefix but the announcement contradicts it. Either a different AS is authorised (invalid_asn) or the prefix is more specific than the ROA's maxLength (invalid_length). Networks that enforce route origin validation as described in RFC 6811 drop invalid routes, so the destination becomes unreachable from those networks even though the announcement is present in BGP.
What does RPKI unknown or NotFound mean?
No ROA covers the prefix, so validation has nothing to check the announcement against. RFC 6811 calls this state NotFound. The route is accepted by everyone, including enforcing networks, but it is unprotected: another AS could announce the same space and its route would look just as legitimate. Publishing a ROA through your regional internet registry turns unknown into valid.
What is maxLength in a ROA?
maxLength is the longest prefix length a ROA authorises the AS to announce. A ROA for 192.0.2.0/23 with maxLength 24 covers the /23 and both /24s inside it. RFC 9319 advises setting maxLength to the prefix length you actually announce, because a loose maxLength lets an attacker announce a more specific route inside your space that still validates as valid.
How do I check if my prefix is being hijacked?
Validate your prefix against the AS that should be announcing it, then read the Currently announced by panel. If an AS you do not recognise appears there, validate that pair as well: an invalid_asn result confirms the announcement is not authorised by your ROA. The BGP Looking Glass then shows which collectors see the rogue route and along which AS-paths it propagates.