In June 2024, a Brazilian ISP announced Cloudflare's IP address as its own, and the internet believed it. DNS resolution dropped across 300 networks in 70 countries. The routes were cryptographically signed. A major carrier accepted the bogus announcement anyway.

The routing protocol that failed was sketched on two napkins in 1989 as a temporary fix. Thirty-seven years and multiple security layers later, it still assumes every participant can be trusted. The patches are real, the progress measurable. Somewhere, a working replacement already carries production traffic. The distance between that fact and the rest of the internet is wider than you'd expect, and not for technical reasons.

In June 2024, a Brazilian ISP announced Cloudflare's IP address as its own, and the internet believed it. DNS resolution dropped across 300 networks in 70 countries. The routes were cryptographically signed. A major carrier accepted the bogus announcement anyway.

The routing protocol that failed was sketched on two napkins in 1989 as a temporary fix. Thirty-seven years and multiple security layers later, it still assumes every participant can be trusted. The patches are real, the progress measurable. Somewhere, a working replacement already carries production traffic. The distance between that fact and the rest of the internet is wider than you'd expect, and not for technical reasons.

BGP's vulnerability was never really technical. It was a coordination problem dressed in protocol clothing. The system assumed honest peers. No verification. Just trust.

RPKI, the cryptographic patch meant to solve this, works through an entirely different mechanism. But it runs on the same fuel. Signing your routes only matters if others validate them. Validating only pays off if others sign. The single best predictor of adoption turns out to be adoption itself.

So the fix doesn't just address the coordination failure. It inherits it whole.

Protection gap: Over half of BGP routes now carry RPKI signatures, yet only about 6.5% of end users sit behind networks that actually enforce validation

Familiar asymmetry: Smaller networks and government institutions lag furthest, lacking the resources and incentives to adopt, echoing BGP's original trust imbalances

Stacking layers: ASPA and BGPsec build atop RPKI but carry their own, sometimes stricter, collective adoption thresholds before they deliver real protection

Trust migration: RPKI's certificate hierarchy concentrates authority in a handful of root entities, swapping one trust dependency for a structurally different one

Wider pattern: DNSSEC and IPv6 exhibit the same circular dependency, suggesting protocol patches structurally inherit the adoption dynamics of what they're patching