Two of the internet's biggest backbone networks have been quietly erasing a safety flag meant to stop routing disasters.
Cloudflare studied adoption of RFC 9234, a BGP extension that lets networks declare their relationship to each other - customer, provider, or peer - and tags routes with an "Only to Customer" (OTC) marker so they can't accidentally propagate back upstream. By watching which peer networks send that OTC attribute across its global peering fabric, Cloudflare built a live picture of how many operators have actually turned the feature on. The finding that stood out: two Tier-1 networks were stripping the OTC attribute entirely as routes passed through them, silently disabling the protection for anyone downstream who relied on it. Cloudflare says it's now working with those networks to get the attribute passed through intact.
Route leaks are the internet's most persistent screwup - a customer hairpins traffic between two of its own providers, or a peer forwards a route somewhere it was never meant to go, and traffic ends up on a path with no capacity to handle it. RFC 9234 exists to catch that automatically instead of trusting every operator to hand-write filters correctly, but it only works if the whole path cooperates. A Tier-1 sits in the middle of most of those paths, so if it drops the flag, every RFC 9234 deployment behind it loses its protection without anyone noticing.
Routing security tools have a long history of slow adoption - RPKI took most of a decade to reach meaningful coverage - and OTC looks headed for the same grind, with an extra early step: getting the networks in the middle to stop quietly turning it off.