RPKI Validator

Check whether an IP address's currently-announced route is protected by RPKI (Resource Public Key Infrastructure) — validated live against Route Origin Authorizations via RIPEstat, no ROA database to keep in sync ourselves.

Enter an IP address above and press Validate.

RPKI lets a network operator cryptographically attest which Autonomous System is authorized to originate routes for their IP prefixes. A route that doesn't match any valid authorization can still be announced — RPKI is opt-in for validation on the receiving side — but a growing share of the internet's routers reject or de-prioritize invalid routes, which is what makes this worth checking.

What the statuses mean

Valid
The announcing ASN and prefix match a published Route Origin Authorization (ROA).
Invalid
A ROA exists for this prefix, but it authorizes a different ASN, or the announced prefix is more specific than the ROA allows — a signal of possible route hijacking or misconfiguration.
Unknown
No ROA covers this prefix at all — most of the internet is still in this state. Also returned (rather than a guess) if RIPEstat itself is unreachable.

FAQ

Live from RIPEstat, which aggregates validator output across all five Regional Internet Registries (RIPE, ARIN, APNIC, LACNIC, AFRINIC) — not a database this site ingests and could fall out of sync with.
The IP's currently publicly-announced route, resolved live — not specific to your own connection's path to it.
Most of the internet doesn't have RPKI ROAs published yet. Unknown is the honest default, not a failure state.

About this tool

RPKI lets the owner of an address block publish a signed statement, called a Route Origin Authorization (ROA), saying which network is allowed to announce it. This tool checks whether the route currently announced for an IP is covered by a valid ROA.

How it works

Validation is carried out live through RIPEstat, so there is no ROA import pipeline on our side that could drift out of date. The result reports whether the route is valid, invalid or not covered by any ROA.

What to keep in mind

A route that is not covered is not necessarily hijacked; many networks have not yet published ROAs. An invalid result means the origin or prefix length does not match what the owner authorized and deserves investigation.

Common uses

Network operators use it to check their own announcements after changing providers, and security teams use it as one input when assessing whether an address block is being announced by the right party.

Related: ASN lookup · IP whois lookup · IP range directory · IP lookup