RPKI and ROAs on 44Net - Revision history

KI5QKX: mw push

2026-09-28T22:28:16Z

mw push

← Older revision		Revision as of 22:28, 28 September 2026
Line 5:		Line 5:
	''Why can’t 44Net publish ROAs?''		''Why can’t 44Net publish ROAs?''

	The short answer is that 44Net subnets are administered by ARIN under "legacy" status, and ARIN does not provide RPKI or IRR services for legacy resources that not covered by an ARIN service agreement.		The short answer is that 44Net subnets are administered by ARIN under "legacy" status, and ARIN does not provide RPKI or IRR services for legacy resources that are not covered by an ARIN service agreement.

	== The basics ==		== The basics ==
Line 13:		Line 13:
	A ROA (Route Origin Authorization) is one of those statements. It says which ASN is authorized to originate a prefix.		A ROA (Route Origin Authorization) is one of those statements. It says which ASN is authorized to originate a prefix.

	~~On many modern networks~~, ~~operators expect ROAs to be~~ '~~Valid~~'. If a ~~route is~~ announced ~~without a valid ROA~~, ~~some providers may treat it as~~ 'Invalid' ~~and filter it out~~. ~~Others~~ may ~~treat~~ it as '~~NotFound~~' ~~and accept it, but that is not guaranteed~~.		Route origin validation compares an announcement with validated ROA data. If no ROA covers the announced prefix, the result is ''NotFound''. If a ROA covers it but none permits the announced origin ASN and prefix length, the result is ''Invalid''. A matching authorization produces ''Valid''. These states are defined in [https://www.rfc-editor.org/rfc/rfc6811.html#section-2 RFC 6811].

			Providers decide which validation states they accept. A provider may reject a ''NotFound'' route without classifying it as ''Invalid''.

	== What that means for 44Net ==		== What that means for 44Net ==

	~~Operationally~~, ~~that means some providers support 44Net prefixes without~~ a ~~valid ROA, while others may not~~. ~~Right now~~, ~~there is no alternative but to petition the provider to~~ make an exception for ~~the route, or to use a provider that is already familiar with handling 44Net space~~.		Before arranging service, confirm whether your provider accepts routes with a ''NotFound'' status. If it requires ''Valid'', ask whether it can make an exception using ARDC's authorization and IRR records. See [[Guide for ISPs#Documentation and validation ARDC can provide\|documentation ARDC can provide]].

	== What is ARDC doing about it? ==		== What is ARDC doing about it? ==

KI5QKX: mw push

2026-08-20T17:39:44Z

mw push

New page

{{DISPLAYTITLE:RPKI and ROAs on 44Net}}

This page answers a recurring question:

''Why can’t 44Net publish ROAs?''

The short answer is that 44Net subnets are administered by ARIN under "legacy" status, and ARIN does not provide RPKI or IRR services for legacy resources that not covered by an ARIN service agreement.

== The basics ==

RPKI (Resource Public Key Infrastructure) is the system used to make cryptographically verifiable statements about Internet number resources.

A ROA (Route Origin Authorization) is one of those statements. It says which ASN is authorized to originate a prefix.

On many modern networks, operators expect ROAs to be 'Valid'. If a route is announced without a valid ROA, some providers may treat it as 'Invalid' and filter it out. Others may treat it as 'NotFound' and accept it, but that is not guaranteed.

== What that means for 44Net ==

Operationally, that means some providers support 44Net prefixes without a valid ROA, while others may not. Right now, there is no alternative but to petition the provider to make an exception for the route, or to use a provider that is already familiar with handling 44Net space.

== What is ARDC doing about it? ==

The foundation monitors the situation and available options as part of its responsibility to steward the address space. If and when there is a development worth sharing, ARDC will update the community. In the meantime, ARDC is happy to discuss exceptions with providers and customers on a case-by-case basis.

== What about SWIP? ==

ARDC does not SWIP customer subnets, because the address space is leased to the customer, not transferred. We also cannot currently add customer- or provider-specific text to the parent ARIN Whois or RDAP record.

== External references ==

* [https://www.arin.net/resources/guide/legacy/ ARIN: Legacy Resources at ARIN]
* [https://www.arin.net/resources/manage/routingsecurity/ ARIN: Routing Security Eligibility FAQs]
* [https://www.arin.net/resources/manage/rpki/ ARIN: Resource Public Key Infrastructure]
* [https://www.arin.net/resources/registry/manage/netmod/ ARIN: Network Modifications]

== Related pages ==

* [[44Net and Modern Internet Assumptions]]
* [[Routing your allocation via BGP]]
* [[Guide for ISPs]]
* [[BGP]]
* [[FAQ]]

[[Category:Reference]]
[[Category:Infrastructure]]
[[Category:BGP]]
[[Category:Routing]]