How the mid-2026 ASPA rollout eliminates BGP route leaks

BGP route leaks routinely misdirect traffic and drop services. The mid-2026 push for Autonomous System Provider Authorization (ASPA) is the current industry attempt to secure transit paths. I spent the last few weeks looking at the deployment data and IETF drafts to understand what this means for daily network operations.

Existing RPKI Route Origin Authorizations lock down the origin of a route, but they do not stop misconfigurations where traffic is improperly re-advertised to create a valley routing anomaly. ASPA attempts to fix this by cryptographically validating customer-provider transit paths. AS holders publish objects listing their authorized upstream providers. Relying Party software like OpenBSD's rpki-client or NLnet Labs' Routinator version 0.13.0+ verifies these records offline. These validators then push Validated ASPA Payloads to routers using an updated RTR protocol. Moving the validation offline lets routers enforce a strict valley-free model and drop leaked routes without the cryptographic overhead that stalled BGPsec.

The infrastructure to publish ASPA objects is live across most of the globe. The RIPE NCC integrated ASPA into its RPKI Dashboard in December 2025, and ARIN followed in January 2026. APNIC deployed support in its portal and Registry API by July, while LACNIC committed to adding capability by the end of 2026. Cloudflare launched a dedicated monitoring feature in Cloudflare Radar in February to track adoption trends. Cisco is running an Early Field Trial for IOS-XR. Open-source daemons common in Internet Exchange Points, specifically OpenBGPD 7.8+ and the mq-aspa branch of BIRD, have also implemented AS_PATH verification.

We are building foundational security on protocols that have not reached final RFC status. The IETF SIDROPS working group has draft-ietf-sidrops-aspa-profile at version 29 and draft-ietf-sidrops-aspa-verification at version 27 as of August 2026. They function as de facto standards right now.

The administrative burden of these drafts falls entirely on the engineers running the networks. ASPA requires strict maintenance of authorized provider lists. If an AS holder brings up a new transit link or fails over to a backup connection at 3 AM and forgets to update their ASPA objects, the network isolates itself. The exact mechanism designed to block route leaks will drop their legitimate traffic.

Tier-one transit providers and large cloud platforms have the engineering teams to automate their RPKI management. They need this level of path validation to prevent large-scale traffic misdirection. For a regional ISP running a lean NOC, ASPA is a loaded gun pointed at their foot. Implementing a draft standard to fix edge case route leaks introduces a high probability of self-inflicted outages. Smaller networks are just going to break their own routing trying to keep up.