RPKI and the Internet Routing Registry, or IRR, both publish information that can be used to build routing filters, but they provide different levels of authority and security. RPKI uses cryptographically verifiable resource certificates; IRR databases are registries of routing-policy objects whose trust and maintenance vary by database.
Two ways of publishing routing intent
In an IRR, an operator can publish route or route6 objects linking prefixes to origin AS numbers, along with other policy records. Networks query those databases to generate prefix filters. RPKI instead derives authority from the IP resource allocation hierarchy and signed ROAs. A validator can cryptographically establish that the holder of an address block authorised a given origin. Modern networks often use both: RPKI for strong origin validation and selected IRR sources for additional filtering information not represented by ROAs.
Why operators still use both
The distinction matters because stale or unauthorised IRR objects have historically complicated filter generation. RPKI was built specifically to establish a verifiable link between number resources and routing authorisations. IRR still remains useful because it contains broader routing-policy data and because not every prefix has a ROA. In practice, careful operators choose trusted IRR databases and combine them with RPKI rather than treating the two systems as interchangeable.
Do not treat the databases as equivalent
RPKI is not automatically 'new IRR'. ROAs are narrower than the full Routing Policy Specification Language used by IRRs, and NotFound routes remain common enough that IRR-derived filters still have operational value. Conversely, an IRR entry should not override an RPKI Invalid announcement simply because a text record exists somewhere. The systems answer overlapping but not identical questions.