RPKI &
Origin Validation
Eliminate BGP hijacks and accidental route leaks. We provide a fully managed, Delegated RPKI Certificate Authority (CA) integrated directly into the IP provisioning workflow.
Route Validator
Validation States
The route announcement matches a signed ROA (Route Origin Authorization) for both the ASN and prefix length. Traffic flows normally.
The announcement contradicts an existing ROA. This indicates a hijack or misconfiguration. We drop these packets at the edge.
No ROA exists for this prefix. Traffic is accepted, but unprotected. We recommend signing ROAs for 100% of your resources.
Automated Signing
Forget managing Krill instances or manual RIR portals. Define your ROAs in Terraform or via API, and we handle the cryptographic heavy lifting with the RIRs (ARIN/RIPE/APNIC).
- 15-minute Global Propagation
- Automated Renewal
- HSM-backed Key Storage
Global Trust Anchors
Security Notice
Netnounce enforces Strict RPKI Validation on all eBGP sessions.
If your upstream announcement is RPKI Invalid, it will be silently dropped by our edge routers. Ensure your ROAs are current before peering.