I use Pi-hole and uBound to add layers of protection to my home network and browsing environment, mainly by filtering DNS requests and blocking unwanted content before it reaches us. Working with these tools has reinforced my interest in how security controls operate at different layers of the network stack, particularly where their effectiveness depends on infrastructure beyond mine. Internet routing is one such layer, and recent RPKI adoption figures provide an interesting perspective on its security.

This article reports a y2y increase in RPKI-valid routed prefixes, from 54% to 70%. The median number of collector vantage points observing invalid prefixes was just two, compared with 596 for valid prefixes, a difference consistent with the role of route origin validation in limiting the propagation of unauthorized announcements. However, RPKI only verifies whether an autonomous system is authorized to originate a prefix; it does not validate the entire AS path, and permissive ROA maxLength settings can still introduce exposure.

The distinction matters because security controls address different failure modes. Pi-hole and uBound help reduce exposure at the DNS and navigation layers, while RPKI addresses route origin authorization at the interdomain routing layer. As a hobbyist, I can configure and maintain the former within my own network, but the latter depends on decisions made by network operators and ISPs. It is a reminder of how much of my network’s security remains outside my direct control.

https://ipinfo.io/blog/rpki-protects-70-internet-routes