RFC 9234 adoption reveals BGP route-leak prevention gaps

Cloudflare has published findings on the adoption of RFC 9234, a standard designed to prevent BGP route leaks by embedding relationship intent directly into the protocol. The study reveals that while 67 networks now use the new BGP Role capability, two large Tier-1 providers continue to strip the Only-to-Customer (OTC) attribute, limiting the standard’s effectiveness across the internet’s core routing infrastructure.

How RFC 9234 works

BGP route leaks occur when traffic is misdirected through unintended paths due to incorrect propagation of routing announcements. Traditional defenses rely on manual prefix filters and IRR-based policies, which are error-prone and require operators to express relationships correctly on every session. RFC 9234 shifts this responsibility into the BGP protocol itself by introducing two key elements: BGP Roles and the OTC path attribute.

BGP Roles define the relationship between two neighboring autonomous systems (ASes) during session establishment. Valid pairings include provider-customer, customer-provider, peer-peer, and route-server/route-server-client. When both sides agree on their roles, the session proceeds; mismatches trigger a rejection, preventing latent configuration errors from causing leaks later. The OTC attribute marks routes that must not propagate beyond customers, enabling compliant routers to automatically reject leaked routes without additional policy rules.

Adoption and limitations

Cloudflare’s analysis, conducted over three months using its global peering network, identified 67 ASes setting the OTC attribute. Route servers and networks using open-source BGP implementations led adoption, with YYCIX being the first to deploy the standard. However, the study also uncovered a critical limitation: two Tier-1 providers, GTT (AS3257) and Arelion (AS1299), strip the OTC attribute from routes they forward. This practice, rooted in defensive measures against past BGP error-handling vulnerabilities, undermines RFC 9234’s ability to prevent leaks propagating through their networks.

The impact is significant. Cloudflare’s experiment found that 33.1% of IPv4 and 17% of IPv6 routes had their OTC attribute removed, with Arelion and GTT accounting for 96.6% and 92.9% of these instances, respectively. While GTT continues to strip the attribute, Arelion has since updated its configurations to preserve OTC, following Cloudflare’s engagement.

What this means for network operators

The findings highlight both progress and persistent challenges in automating BGP security. Early adopters of RFC 9234 gain immediate protection against route leaks, but the standard’s effectiveness depends on widespread support, particularly among Tier-1 providers. Networks relying on GTT or Arelion for transit may still experience degraded route-leak prevention until these providers fully align with the standard.

Next steps

Cloudflare plans to release ongoing adoption data via its Radar platform, providing visibility into RFC 9234’s deployment. The company also encourages operators to pressure vendors lacking support, such as Cisco IOS XR (planned for release 26.4.1) and Nokia SR OS, to prioritize implementation. Without broader adoption, route leaks will remain a manual and inconsistent process, leaving the internet vulnerable to misconfigurations and attacks.