The IRR Database Cleanup Nobody's Tracking

RPKI got the attention. Cyber-insurance language rewritten, hyperscaler peering policies tightened, deployment curves bending upward. The industry has had three years of sustained conversation about routing security, and it's producing real results.

Meanwhile, the IRR (Internet Routing Registry) databases that route filters still depend on have not been getting the same attention. Half the route filters in production reference IRR objects that haven't been updated since the operator was acquired by an operator who got acquired by a third operator. The records exist. They no longer match reality. Nobody is responsible for fixing them.

This is the cleanup nobody's tracking, and it's about to start mattering.

Why IRR still matters even with RPKI

RPKI validates origin. ROAs say "this AS is authorised to originate this prefix". That catches origin hijacks.

IRR validates more. Route objects say "this prefix is announced by this AS". aut-num records describe import/export policy. as-set objects group ASes. Transit operators still build route filters from IRR data to decide what to accept from a peer.

The two systems overlap on the origin question — RPKI does that better. But IRR also carries what RPKI doesn't: announced paths, expected AS-paths, normal aggregations. None of that goes away.

A transit operator who switches off IRR filters because "we have RPKI now" has made their network more permissive, not less. They replaced one filter with a weaker filter, not added a layer.

The staleness problem

IRR databases are old. Some go back to 1995. The records carry decades of routing history. Mergers, acquisitions, divestments, ASN transfers — each should trigger updates. Most don't.

Any given prefix in the table might have IRR records that are correct, stale (AS no longer exists), wrong-AS (prefix transferred without update), missing entirely, or contradictory across registries.

A 2024 survey I read estimated 35% of advertised prefixes have IRR records that are stale, wrong-AS, or contradictory. A further 15% have no IRR records. Combined, half the routing table has IRR data that doesn't match reality.

RPKI was supposed to make this less important. It did the opposite — made it more invisible, because the conversation about routing security focused entirely on RPKI and the underlying IRR rot continued unchecked.

Why this is about to bite

Three converging pressures.

Hyperscaler peering policy is tightening. They look at whether a transit's filters are credible, not just whether they have RPKI. Transits whose customer prefixes routinely fail IRR validation look operationally weaker.

Cyber-insurance underwriting added IRR questions in 2025. Following the RPKI playbook from 2024, underwriters are slowly figuring out that routing security depends on both halves.

RIR transfer rules now require IRR updates alongside ROA updates. A prefix transfer that doesn't include the IRR refresh is increasingly going to face challenges from the registries themselves.

None of this is yet a forcing pressure for most operators. Twelve months from now it will be.

What clean looks like

A well-maintained IRR presence has six properties.

Route objects for every announced prefix. aut-num records that describe actual transit and peering relationships. as-set records reflecting the current customer cone. Maintainer credentials current and accessible. Cross-registry consistency (RIPE / ARIN / APNIC records that don't contradict each other). Stale records deleted when prefixes stop being announced.

Most ASes I look at fail at three to five of these. The cleanup is unglamorous and slow.

The cleanup playbook

Three steps.

Audit what you have. Pull every IRR record under your ASN from every registry. Compare to current announcements. List the gaps — route objects for prefixes you don't announce, prefixes you announce without route objects, contradictions.

Assign ownership. Most cleanups fail because no individual owns it. Route objects belong to the routing team. Maintainer credentials belong to network ops. as-sets belong to the peering team. Without explicit ownership, the cleanup is everyone's problem and nobody's job.

Make incremental progress with deadlines. Quarterly milestones. Q1: route-object coverage for top 80% of traffic. Q2: as-set cleanup. Q3: aut-num refresh. Q4: cross-registry consistency. A year of work for a medium AS. Pretending it can be done in a week guarantees it doesn't happen.

The political reason this is slow

IRR cleanup looks bad on the way out. An audit reveals records that should have been maintained for years and weren't. The team that owns IRR has accountability for the gap. Publishing the audit creates internal exposure.

Most teams I've watched start an IRR cleanup hit the same moment: fix it quietly, or escalate. The quiet fix is easier short-term and worse long-term. Escalation gets resources but generates the political exposure the team was trying to avoid.

That's the structural reason IRR rot persists. Not technical. Organisational.

What I'd push for

Three policies if I were running an AS.

Mandate IRR record creation as part of prefix announcement workflow. No new prefix announced without the record verified. This stops the rot from growing.

Quarterly automated audit against current announcements. A script that pulls IRR records and compares to the routing table. Flag discrepancies. Review them in a team meeting. This catches drift before accumulation.

Annual full cleanup as a scheduled operational task. Block a week per year. Treat it like an audit response — boring, necessary, not optional.

None of this is glamorous. None shows up on a conference slide. Networks that maintain IRR hygiene have cleaner peering relationships and fewer "your filters dropped my prefix" tickets. Networks that don't accumulate technical debt that bites at the worst time.

The RPKI conversation will keep dominating the routing-security narrative. The IRR cleanup will keep being underweighted. The operators who notice the gap quietly will have a structural advantage nobody else is publishing about.

Pull the audit. Start the cleanup. Worth doing.