Since 2024, Nexim has been operating with strict RPKI Route Origin Validation: INVALID routes are dropped (not merely deprioritized). Results:
- 0 route hijack incidents towards our customers
- 0.003% legitimate routes dropped due to ROA misconfiguration upstream (automatic notification to peer)
- +18ms average added latency (negligible)
- 3 public incidents resolved via MANRS coordination
Our policy + tooling are open source: github.com/nexim/rpki-strict-tools (to be published).