New release of Internet.nl features RPKI test

RPKI will help reduce accidental and malicious internet routing errors

As of today, you can use Internet.nl to test whether your website and mail service are protected by RPKI: a modern internet standard that helps reduce accidental and malicious internet routing errors. That's important, because such errors could lead to the unavailability of your website or mail service. We promote the use of secure internet standards such as RPKI, and we're proud to partner Internet.nl. So we'd like to see as many people as possible running the new test on their websites and mail services.

Route leaks and hijacks

RPKI and the DNS: role of big players is crucial RPKI and the DNS: protection levels going up, but still lots of room for improvement Implementation of existing standards would make the internet much more secure

Resource Public Key Infrastructure (RPKI) is a technology designed to prevent certain types of route leaks and hijacks. Such incidents can lead to internet traffic being redirected to systems on unauthorised networks. They may be simple accidents, where a network administrator makes a slip typing a URL, so that internet traffic is sent to the wrong place. Or they may involve an attacker targeting the internet infrastructure to make websites unreachable or to steal data from users. In 2014, for example, a set of IP addresses belonging to the Dutch Ministry of Foreign Affairs was temporarily hijacked by a Bulgarian network operator.

How RPKI works

RPKI allows the legitimate owner of a block of IP addresses to publish a digitally signed statement about how traffic from their network should be routed. Known as Route Origin Authorizations (ROAs), such statements can be cryptographically validated by other network administrators and then used to set up filters. Routers can then filter out routes that violate the ROAs published for the corresponding IP addresses (invalid = reject).

To work, RPKI therefore requires the active support of two parties. First, an IP address's owner needs to publish ROAs. Second, a party that receives routes from other networks under the Border Gateway Protocol (BGP) has to filter on the basis of all globally published ROAs, and never accept or advertise invalid routes.

RPKI test on Internet.nl

RPKI support is now checked as part of Internet.nl's website test and e-mail test. All IP addresses found for a domain's web server, mail servers and name servers are included.

First, the system checks whether at least one ROA has been published for each IP address. Next, it verifies whether any of the ROAs found matches the route announcement for each address. The results of the RPKI test don't yet count towards the overall website test score or e-mail test score. However, they will do from early 2023. Later this year, the RPKI test will also be added to the Internet.nl API and dashboard.

Much of the credit for development of the new RPKI test goes to NCSC-NL, who also made the code available on an open-source basis, in line with the government's standing "open, unless" policy. The work involved close collaboration with Internet.nl's core developers, who work for the Platform for Internet Standards. The RPKI test is based on Routinator, open-source RPKI Relying Party software developed by NLnet Labs.

Screenshot of the result of the RPKI test of sidn.nl on Internet.nl

Figure 1: Screenshot of the result of the RPKI test of sidn.nl on Internet.nl.

Additional security

Various internet routing security technologies are available to complement RPKI. The MANRS initiative provides an overview of best practices, which we recommend using in combination with RPKI.

About Internet.nl

The Internet.nl test tool is an initiative by the Platform for Internet Standards, set up by various internet community players and the Dutch government. The Platform was formed as a vehicle for cooperative efforts to increase the use of modern internet standards, with the ultimate goal of making the internet more accessible, secure and reliable for everyone. The code of the Internet.nl software is available under an open-source licence.