Add RPKI ASPA Checks to Your Proxy Route Preflight

#networking #devops #webscraping #security

An exit-IP check tells you where an application request emerged. It does not tell you whether the BGP path carrying that prefix is consistent with the provider relationships published for the participating autonomous systems.

RPKI ASPA validation adds that missing signal. It does not replace endpoint tests; it produces a routing classification that can sit beside them.

Minimal evidence schema

Capture one record per new prefix, origin, or material path change:

{
  "observed_at": "2026-08-27T07:15:00Z",
  "proxy_region": "eu-west",
  "address_family": "IPv4",
  "exit_prefix": "documentation-prefix",
  "origin_asn": "documentation-asn",
  "collector_vantage": "western-europe",
  "raw_as_path": ["AS-A", "AS-B", "AS-B", "AS-C"],
  "normalized_as_path": ["AS-A", "AS-B", "AS-C"],
  "aspa_result": "Unknown",
  "roa_origin_result": "Valid",
  "endpoint_test": "pass"
}

Keep the raw path. If your validator requires collapsing consecutive prepends, store the normalized path as a separate field. Never delete an unexpected ASN just to make a result pass.

Classification logic

Avoid a boolean route_ok field. Preserve the validator’s three states:

function decide(sample) {
  if (sample.aspa_result === "Invalid") {
    return "quarantine_and_reproduce";
  }

  if (sample.aspa_result === "Unknown") {
    return sample.endpoint_test === "pass"
      ? "limited_use_with_recheck"
      : "hold";
  }

  return sample.roa_origin_result === "Valid" && sample.endpoint_test === "pass"
    ? "eligible_for_controlled_rollout"
    : "hold";
}

That example deliberately refuses to let ASPA override a failed endpoint or origin check.

Where to place the check

Run the validation when:

a new proxy prefix appears;
the origin ASN changes;
the AS path changes materially;
a routing incident is reported;
a periodic review is due.

Do not run it on every page request. AS-path validation is route evidence, not a per-transaction health check.

What to alert on

Good alerts identify transitions:

Valid or Unknown becomes Invalid;
a new origin ASN appears;
independent collectors disagree;
IPv4 and IPv6 show different risk states;
a quarantined path reappears before re-entry criteria are met.

Before escalating Invalid, reproduce the path from a second vantage point and verify the timestamp, address family, and normalization. If it remains Invalid, send the provider the raw path and observation details instead of a screenshot alone.

Final guardrail

A Valid ASPA result does not prove that an IP is residential, fast, private, or contractually appropriate. Keep separate checks for geography, ASN identity, DNS routing, TLS, first-attempt success, sticky sessions, permitted use, retention, and incident handling.

Disclosure: I work with 98IP. This is a vendor-neutral engineering workflow, not a claim that ASPA alone proves proxy quality. More proxy-testing material: https://en.98ip.com/?k=dev
``

DEV Community