When people talk about internet security, they usually focus on SSL certificates (the little lock icon) or strong passwords. But there's a deeper, invisible layer of the internet that's often left vulnerable: the route itself.
Imagine sending a secure armored truck (your encrypted data) to a bank. If a criminal changes the road signs and diverts that truck to a fake warehouse, the armor doesn't matter. The cargo is gone.
That's exactly what RPKI (Resource Public Key Infrastructure) prevents. For domain owners, network administrators, and compliance officers, implementing RPKI is no longer optional if you want real control over your digital presence.
What is RPKI, and what is BGP hijacking?
The internet is a network of networks that talk to each other using a language called BGP (Border Gateway Protocol). BGP is efficient, but it was built in the 1980s on trust: if a network says "send traffic for Google.com this way," other networks just believe it.
That trust gets abused in attacks known as BGP hijacking. Malicious actors, or clumsy network engineers, can announce that they "own" an IP address belonging to someone else. Traffic meant for your website or email server then gets routed through a hacker's server first.
RPKI is the fix. Think of it as a cryptographically signed registration plate for your IP addresses.
- ROA (Route Origin Authorization): the digital document that says "only Network X is authorized to announce this IP address."
- Route Origin Validation: the process other routers use to check that registration plate before sending traffic. If it doesn't match, the traffic is dropped or flagged.
Why your nameservers and mailservers need RPKI too
Most people stop at securing their web server. But your domain relies on a chain of services: your nameservers (DNS) and your mailservers (MX). If any link in that chain is hijacked, your domain is compromised.
This is where many domains fail compliance checks: it's not enough to secure your website's IP alone. You have to verify the entire chain.
The DNS vulnerability (nameservers)
Your nameserver is the phonebook of your domain. If a hacker hijacks the route to it, they can answer queries for your domain with their own fake IP addresses.
- The risk: users type
yourbank.com, but the hijacked DNS sends them to a phishing site that looks identical. - The fix: RPKI on your nameserver's IP ensures that requests to find your website actually reach your real DNS provider.
Email interception (mailservers)
Email is the lifeblood of corporate communication, and BGP hijacks against mailservers are often used for man-in-the-middle attacks.
- The risk: a hacker hijacks the route to your MX (mail exchange) IP, receives your corporate email, copies it, then forwards it on. You never know you were breached.
- The fix: valid RPKI ROA records on your mailserver IPs prevent unauthorized networks from stealing your traffic.
The "fourth party" risk (nameservers of your mailservers)
This is the check most tools miss. Your mailserver (say, mail.example.com) is defined by a domain name, and that domain name has its own nameservers.
If the nameserver of your mailserver gets hijacked, the attacker can redirect your email flow without ever touching your actual mail server, a tiered attack that bypasses standard defenses.
Why domain compliance now requires RPKI
Compliance today means proving control over your infrastructure.
Trust and reliability matter: if your routes are leaked or hijacked, your site goes offline or slows to a crawl, and RPKI prevents these "accidental" outages caused by ISP typos. Data integrity matters too: you can't claim to be GDPR or SOC2 compliant if you can't guarantee that traffic to your servers isn't being routed through a hostile nation-state because of a BGP leak. And vendor due diligence matters, because you're responsible for the third parties you use. If your external DNS provider or email service doesn't have RPKI, they're a weak link in your security chain.
How to check your status
Verifying RPKI manually is hard, since you have to cross-reference DNS records, IP resolutions, and ASN databases for every component of your infrastructure.
That's why tools like CompliSight exist. The SetEnforce tool looks deeper than standard validators: it doesn't just check your website, it audits the full chain of trust.
- The domain IP: is your web server route valid?
- The nameservers: is your DNS provider protected against route hijacking?
- The mailservers: is your email infrastructure safe from interception?
- The recursive dependencies: are the nameservers controlling your mailservers secured?
Conclusion
The internet is moving toward a "default deny" state for invalid routing, and major providers are already dropping traffic without valid RPKI signatures. If your domain's infrastructure, or your vendors', isn't signed and valid, you risk becoming invisible to parts of the world.
Don't wait for a route leak to take your business offline. Audit your infrastructure, demand RPKI compliance from your vendors, and verify your full stack today.
Check your domain's full routing compliance now at cs.setenforce.org.