Dear Job,
On 10 Oct 2025, at 15:35, Job Snijders <job@sobornost.net> wrote:
Dear Edward,
Many thanks for trying to engage with entities related to RIPE-NONAUTH.
You're welcome.
On Fri, Oct 10, 2025 at 03:00:12PM +0200, Edward Shryane wrote:
The NCC were asked to solicit feedback from those who would have objects deleted due to the proposed cleanup of the RIPE-NONAUTH database. We emailed a notification to users on the 15th September.
We found 16,497 RIPE-NONAUTH route(6) prefix matching an RPKI VALID ROA. We sent 514 notification emails to the maintainers of those objects.
Did any users respond to these 514 notifications?
Apologies I wasn't clear, there were 33 replies in total to *both* sets of emails. We received 5 replies to the 514 "matching an RPKI VALID ROA." emails, and 28 replies to the 1,635 "matching the authoritative RIR" emails.
We matched 27,449 RIPE-NONAUTH route(6), as-set, aut-num objects which primary key exactly matched an object in an authoritative RIR database. We sent 1,635 notification emails to the maintainers of those objects.
We received replies from 33 users. 10 of those users confirmed that a total of 15 object(s) could be deleted and 23 asked us not to delete a total of 113 objects.
To summarise the feedback on why they still need the objects: * Objects belong to a third party hosting company or CDN. The ISP is just hosting those resources. * They are the maintainer of the NONAUTH objects. However, the objects are being used by ISPs. * The maintainer is actively using those NONAUTH resources. * They cannot control how the multiple service providers handle traffic. They had some issues in the past due to some policies written by those organisations. * Creation of ROA or ROUTE objects (with the same structure) is not possible in ARIN. * Network complications. They cannot get transit in their own country. They use a VPN to Europe. So, they need to be registered in NONAUTH. * Satellite service provider which customers that use their network. * The user is busy and doesn’t have time for checking this. * They are the owners of those objects and are using them.
So 23 users indicated they'd rather not have the objects deleted. It seems to be a very very small group compared to the overall number of outreach attempts that RIPE NCC performed. There is no doubt in my mind that many of the resources (non-exclusively) listed in RIPE-NONAUTH currently are in actual use, but from that fact it doesn't necessarily logically follow that because those resources are in use - it is necessitated to have objects in RIPE-NONAUTH. I wonder if the users are aware that they can continue using the resources without RIPE-NONAUTH object.
Yes I think so, some of the responses confirmed that we can delete the objects, after we explained that they can create objects in the authoritative RIR instead. It's very important that the notification email template explains this clearly also.
A nit: I can't say I feel super sympathetic towards (some of the) users stating "i don't have time for this", but I do appreciate the honesty :-)
I also appreciate that they had taken the time to reply! But I think regardless of the reason, we shouldn't delete their object(s) if they tell us they still have a need for them. We can always follow-up in future to see if it's still the case.
The feedback that ROA/ROUTE creation is not possible with ARIN obviously does not apply to the 16,497 RIPE-NONAUTH objects which are RPKI VALID (without RPKI ROA those wouldnt be VALID, and if an operator can make a ROA they also can make a route object).
Perhaps we could explain the process for each RIR separately, so it's clear how they can replace their NONAUTH object(s).
It probably doesn't come as much of a surprise given the rich multi-decade history of this dataset, but it seems there are different categories of users with slightly different needs... which may help provide a path towards deprecation by doing continuing step by step.
I agree on the step by step approach, so we notify users and don't delete objects in use. I think the existing cleanup jobs are doing this successfully.
We found the feedback useful, in particular the importance of notifying maintainers in advance and allowing them to opt-out if they are still using the objects. However the continued use of RIPE-NONAUTH will make it more difficult to deprecate the database in the future.
Please let me know your feedback on our findings. I will also present at the DB-WG session at RIPE91 for discussion.
With the survey results in mind, is it considered feasible to proceed with the suggestion to delete "RPKI VALID" route objects from the RIPE-NONAUTH dataset?
I'd like to invite discussion from the community on the survey results, and whether we should proceed with *both* proposed cleanups under a new NWI ? Regards Ed Shryane RIPE NCC
Kind regards,
Job