RPKI and ROAs on 44Net: Difference between revisions

Latest revision as of 22:28, 28 September 2026

This page answers a recurring question:

Why can’t 44Net publish ROAs?

The short answer is that 44Net subnets are administered by ARIN under "legacy" status, and ARIN does not provide RPKI or IRR services for legacy resources that are not covered by an ARIN service agreement.

The basics

RPKI (Resource Public Key Infrastructure) is the system used to make cryptographically verifiable statements about Internet number resources.

A ROA (Route Origin Authorization) is one of those statements. It says which ASN is authorized to originate a prefix.

Route origin validation compares an announcement with validated ROA data. If no ROA covers the announced prefix, the result is NotFound. If a ROA covers it but none permits the announced origin ASN and prefix length, the result is Invalid. A matching authorization produces Valid. These states are defined in RFC 6811.

Providers decide which validation states they accept. A provider may reject a NotFound route without classifying it as Invalid.

What that means for 44Net

Before arranging service, confirm whether your provider accepts routes with a NotFound status. If it requires Valid, ask whether it can make an exception using ARDC's authorization and IRR records. See documentation ARDC can provide.

What is ARDC doing about it?

The foundation monitors the situation and available options as part of its responsibility to steward the address space. If and when there is a development worth sharing, ARDC will update the community. In the meantime, ARDC is happy to discuss exceptions with providers and customers on a case-by-case basis.

What about SWIP?

ARDC does not SWIP customer subnets, because the address space is leased to the customer, not transferred. We also cannot currently add customer- or provider-specific text to the parent ARIN Whois or RDAP record.

External references

Related pages

@@ Line 5: / Line 5: @@
 ''Why can’t 44Net publish ROAs?''
-The short answer is that 44Net subnets are administered by ARIN under "legacy" status, and ARIN does not provide RPKI or IRR services for legacy resources that not covered by an ARIN service agreement.
+The short answer is that 44Net subnets are administered by ARIN under "legacy" status, and ARIN does not provide RPKI or IRR services for legacy resources that are not covered by an ARIN service agreement.
 == The basics ==
@@ Line 13: / Line 13: @@
 A ROA (Route Origin Authorization) is one of those statements. It says which ASN is authorized to originate a prefix.
-On many modern networks, operators expect ROAs to be 'Valid'. If a route is announced without a valid ROA, some providers may treat it as 'Invalid' and filter it out. Others may treat it as 'NotFound' and accept it, but that is not guaranteed.
+Route origin validation compares an announcement with validated ROA data. If no ROA covers the announced prefix, the result is ''NotFound''. If a ROA covers it but none permits the announced origin ASN and prefix length, the result is ''Invalid''. A matching authorization produces ''Valid''. These states are defined in [https://www.rfc-editor.org/rfc/rfc6811.html#section-2 RFC 6811].
+Providers decide which validation states they accept. A provider may reject a ''NotFound'' route without classifying it as ''Invalid''.
 == What that means for 44Net ==
-Operationally, that means some providers support 44Net prefixes without a valid ROA, while others may not. Right now, there is no alternative but to petition the provider to make an exception for the route, or to use a provider that is already familiar with handling 44Net space.
+Before arranging service, confirm whether your provider accepts routes with a ''NotFound'' status. If it requires ''Valid'', ask whether it can make an exception using ARDC's authorization and IRR records. See [[Guide for ISPs#Documentation and validation ARDC can provide|documentation ARDC can provide]].
 == What is ARDC doing about it? ==