The internet's routing security depends on a network of underfunded, volunteer-operated servers. These servers run the Resource Public Key Infrastructure, known as RPKI, a system designed to prevent malicious traffic redirection. Yet the question of who actually maintains this critical infrastructure reveals a surprising and fragile reality.

What You Need to Know

RPKI helps verify that internet traffic routes correctly. While large providers run some servers, the majority are operated by small organizations or individuals with limited resources. This decentralized model raises concerns about reliability and security.

The RPKI Ecosystem

RPKI creates a cryptographic trust chain for BGP, the protocol that directs traffic across the internet. When a network announces routes, RPKI allows other networks to verify that the announcement comes from the legitimate owner of the IP address block. Without RPKI, an attacker can hijack traffic by claiming ownership of IP space. The system depends on a distributed set of servers known as RPKI validators and repositories.

Who Runs the Servers

The largest RPKI servers belong to the five Regional Internet Registries, including RIPE NCC, ARIN and APNIC, but the majority of RPKI validators are run by volunteers, small internet service providers and nonprofit organizations. Many operators maintain only a single server with minimal redundancy. The community encourages this decentralization to avoid a single point of failure, yet the financial and operational burden falls on a small group of participants.

The Hacker News discussion that sparked this topic highlighted how even the most dedicated volunteers struggle with funding. A handful of projects, such as Routinator and OctoRPKI, rely on open-source contributions. The operators often pay for hosting out of pocket.

Key Challenges

  • Funding: Many servers rely on donations or volunteer effort, which is unsustainable as traffic grows.
  • Coordination: No central authority ensures consistent software updates or security patches across all servers.
  • Scalability: As more networks adopt RPKI, the validation load increases, potentially overwhelming small operators.

These challenges compound. A single misconfigured or outdated validator can cause entire networks to reject legitimate routes, degrading internet performance globally.

Why This Matters

The reliance on volunteer-run RPKI servers creates a hidden vulnerability in internet infrastructure. If a critical mass of these servers goes offline or becomes compromised, BGP hijacking attacks become easier to execute. Large tech companies and governments that already deploy RPKI should consider funding the decentralized infrastructure that makes the protocol function. Without a sustainable model, the security of global routing remains at risk. The conversation that started on Hacker News reflects a broader trend: the internet backbone depends more on goodwill than on institutional support.