Cloudflare says a routing-safety mechanism designed to stop BGP route leaks is now visible enough on the public Internet to measure — but not yet deployed enough for operators to treat it as a default safety net.

In an Aug. 18 engineering post, Cloudflare detailed its measurement of RFC 9234 adoption, the standard that adds BGP Roles and the “Only to Customer” attribute to help routers reject routes that should not be propagated outside their intended business relationship.

The hosting relevance is straightforward: route leaks can send customer traffic through unintended networks, causing reachability problems, latency spikes, or outages that look like application failures even when a server is healthy. CDN, DNS, cloud and hosting providers sit close to this blast radius because they depend on stable Internet routing to keep sites reachable globally.

Cloudflare said it used its global peering footprint to track which autonomous systems send the OTC attribute to Cloudflare. The company also reported an unexpected finding: two large Tier 1 networks were stripping the OTC attribute from routes they forwarded. Cloudflare said it has been engaging with those networks because stripping OTC weakens route-leak prevention for early adopters.

RFC 9234 is meant to move part of route-leak prevention out of hand-written operator policy and into BGP itself. Instead of every network relying solely on prefix filters and relationship rules maintained per session, BGP Roles let neighboring networks declare whether a session is provider, customer, peer, route server, route-server client, or similar. The OTC attribute then marks routes that should only travel toward customers.

For site operators, the takeaway is not that BGP Roles replace good provider selection or multi-homing. It is that routing hygiene is becoming another infrastructure control worth asking about, alongside RPKI, DDoS mitigation, DNS redundancy and incident transparency. Hosting buyers rarely see BGP policy, but they feel its failures quickly when checkout pages, SaaS dashboards, APIs or customer portals disappear from parts of the Internet.

Cloudflare’s post also underscores the slow-adoption reality of Internet infrastructure standards. Partial deployment can help, but strict enforcement is not practical until more networks support the role capability consistently. That leaves major networks, CDNs and hosting providers with a transition period where measurement, disclosure and pressure on upstreams may matter as much as the standard itself.

Source: Cloudflare Blog, “BGP Role model: tracking the adoption of RFC 9234.”