What BYOIP Includes: ROAs, IRR, LOA Explained

By Savvas Bout, Founder of Prefixx. Last updated 13 November 2026.

A typical team finds out what’s included in BYOIP after they have committed to a cloud provider or leased a collocation space.

When you bring your own IP address range, announcements can be delayed, geo-targeting may break, and a previous owner's reputation issues can be inherited.

There are several components including documentation of transfer eligibility for public IP address ranges, preparation of Letter of Authorization, ROA signing for the address range, IRR route objects creation, reverse DNS delegation, and on-going monitoring of prefixes' reputation.

This article covers all the components required for complete BYOIP deployment. It explains what provider or a broker should do to facilitate the process and what you need to do to complete the transfer. Understanding each step of the migration process helps teams avoid common pitfalls when moving address space between providers or into cloud environments.

What BYOIP includes: the complete picture

BYOIP, Bring Your Own IP, allows customers to advertise their own IP space within a provider's Routing Table, yet that space remains fully ownered (i.e. registered at the appropriate RIR). Routing to that space is re-directed. Owner ship of the space never moves. Each BYOIP arrangement is comprised of five basic components.

Your IP addresses, IP prefixes, range, and the ASN behind it

A foundation for your IP address space consists of an IP address range registered to your company with a respective IP address registry such as ARIN, RIPE NCC, APNIC etc. as well as an autonomous system number (ASN) to originate the prefixed IP address space via BGP.

The authorization layer: RPKI, IRR, and LOA

Three documents permit you to advertise an address space:

• Route Origin Authorization (ROA): a cryptographic record signed via RPKI that binds your prefix to a specific origin ASN. This is the route origin authorization that modern networks validate.
• IRR route objects: published in a routing registry so that legacy filters and NOC teams can verify the announcement.
• Letter of Authorization (LOA): issued to the hosting or cloud provider, confirming you permit them to advertise your IP space on your behalf.

What BYOIP does not include: IP addresses ownership transfer

When you bring your own IP address space to a new ISP, BYOIP refers to where that address space will announce from, not who owns the address space. The RIR records for your address space will continue to reflect that you own the space. The ownership record at the RIR remains unchanged even when the IP addresses are announced from a different autonomous system number.

Our team at Prefixx completes all LOA, ROA, and IRR objects for each deal before your address space is announced via BGP.

How BYOIP works: routing your IP addresses through a provider

BYOIP enables customers to announce their own public IP space within a provider's network without losing ownership of the address space.

Ownership, authorization, and BGP advertisement

Ownership lives in the regional internet registry RIR resource database. The RDAP record names your organization as the registered holder. Authorization is separate: a cryptographically signed object called a ROA (route origin authorization) is created inside resource public key infrastructure, naming the provider's autonomous system and the maximum prefix length it may announce. The regional internet registry that maintains your ownership record depends on your geographic allocation, such as RIPE NCC in Europe or the american registry ARIN in North America.

An LOA issued to the provider confirms permission in writing. Advertisement is the final layer: the provider's BGP routers originate the prefix, and the internet routing registry route objects corroborate that announcement for networks that filter on IRR data. The route objects serve as a reference point that other networks can query to validate the legitimacy of the announcement.

The six-step hard coded sequence

Where Prefixx fits in

Prefixx prepares all the necessary ROA, IRR route objects and LOA paperwork for you, which will be included with your lease offer and for BYOIP deployments to Netrouting bare metal servers.

IP range requirements: what IP addresses qualify for BYOIP

Not every IP block can be brought to cloud environments or a hosting platform with BYOIP, but all blocks have to go through a defined set of checks to see if they are eligible. Here is an overview of what has to be checked for each block.

Qualifying IP address space and prefixes

1. The minimum prefix size is a /24. Most cloud providers and hosting networks enforce a /24 minimum for IPv4 addresses. Smaller subnets are usually filtered out by routing and won’t propagate.
2. A block must be registered by a business or institutional entity, not by an individual. The associated RDAP record must reflect an organization, not a person.
3. For Public IP address space only (publicly routable). Space must be publicly routable, RFC 1918 private address space and other reserved address space is out of bounds regardless of registration.

RIR record requirements

1. Our standing with the regional internet registry is clean, no transfer locks, no open disputes and no delinquent fees. Each of the RIRs, ARIN, RIPE NCC, APNIC, LACNIC and AFRINIC, has its own resource public key infrastructure and resource database. We use the RDAP record to check against both.
2. Legacy resources can qualify for legacy number space for old IP blocks that were allocated prior to modern RIR policy and are still valid today. This also requires that the resources are properly registered and that the holder of the resources has signed the appropriate agreement for legacy resources.

Maximum prefix length and route acceptance

1. Maximum prefix length must be respected. Most IPv4 networks will refuse to accept routes with a prefix length longer than /24. A more specific route (e.g. /25, /28) will be discarded by your upstream peers.

Note: If you are unsure whether your space meets these criteria, Prefixx reviews the RIR record and routing hygiene before any BYOIP deployment. Tixx checks ownership, transfer eligibility and blacklist status on every block. Once eligibility is confirmed, the next question is which cloud platform you are bringing that space into.

BYOIP on cloud providers: AWS, GCP, Azure and Cloudflare magic transit

Cloud migration to platforms such as Amazon Web Services (AWS), Microsoft Azure and Google Cloud is driving adoption of BYOIP. The onboarding processes for each of the cloud platforms are different but essentially require the same information, such as your IP address range details, to verify control of a prefix prior to an announcement being made.

AWS: certificate, ROA, and AWS region binding

To use a prefix on AWS, you need to supply a self-signed X.509 public certificate, public key and signed message which ties the prefix to your AWS account. The route origin authorization ROA is then validated against the RPKI by AWS before the prefix is advertised into the chosen region. This certificate-based verification process ensures that only the legitimate holder of the prefix can associate it with their AWS account.

Address space that has been onboarded is tied to a specific region and cannot ‘float’ between cloud-based resources in other regions unless you have gone through the onboarding process for those locations as well. Each cloud platform, including how AWS advertises your prefix, enforces regional constraints on where imported address space can be used.

The certificate expires and must be tracked for renewal in conjunction with the ROA. Monitoring the expiration date is essential to maintain uninterrupted routing authority for your prefix.

GCP and Azure: broadly similar flows

GCP and Azure follow similar ROA-plus-LOA models.

Cloudflare magic transit: ddos-oriented announcement

Cloudflare Magic Transit is an alternative to announce the prefix(es) of interest from within Cloudflare’s edge locations and have traffic there scrubbed by DDoS systems and then forwarded to your origin servers via high-performance tunnels.

Most other brokers have self-serve onboarding portals to handle all the paperwork for you. For Prefixx, where we do prepare the LOA, RPKI ROA, and IRR route objects for your IP block address range for you, and support deployment to all four platforms, the resulting documentation can be sent to you to be submitted to the relevant platform.

What gets transferred with the block to any of those platforms, however, is not just simple IP address space routing rights.

Bring your own IP vs. Provider-assigned addresses: when to switch

Both provider-assigned IPs and BYOIPs cover the same surface-level need of getting a sufficient address range of routable IPs deployed under an autonomous system number, but differ dramatically with respect to issues of ownership, portability, and long-term control. The decision between them depends on what you actually own, and how much those addresses matter to your operation. BYOIP arrangements provide greater control over routing decisions and infrastructure choices compared to provider-assigned allocations.

Ownership and address space portability

A provider-assigned IP address is owned by the hosting company. When you change providers, all their IP addresses travel with them and need to be renumbered in DNS, firewalls, etc. as well as all the hard-coded IP addresses on other systems that you interact with.

Organizations that treat their IP address space as IP assets which they can move from environment to environment need to use BYOIP. Maintaining consistent IP addresses across the online world ensures that external integrations and security policies remain intact without manual reconfiguration.

BYOIP allows you to advertise your own IP range from your upstream. Most network operators run their own ASN, and many businesses use their own IP range for reasons related to their reputation score, geolocation, and allowlisted services, all tied to a specific IP range. The ability to bring your own IP preserves continuity when migrating workloads across different infrastructure environments or switching upstream providers.

The setup trade-off

Providing new IPs from Internet Service Providers (ISPs) is generally fast (no documentation, RIR configuration. RPKI configuration etc.) vs. BYOIP which has its own set of challenges in terms of the time it takes to complete the migration process for RIR verification. RIR verification and RPKI configuration alone can require several business days before the address space is ready for announcement.

ROA signing with private key, IRR creation of route-objects, LOA generation etc.

Cloud migration and continuity

Keeping public-facing IP addresses constant during a cloud migration project means that a whole class of risk simply goes away. There’s no need to go update hard-coded IP addresses in partner systems, payment processes, or API allowlists, all of the LOA, ROA, and IRR objects are handled for you by Prefixx. This stability also means that references to your IP addresses on other websites, in documentation, or in third-party integrations remain valid without requiring coordination or updates.

We recommend BYOIP for highly portable and operationally critical addresses. Here is how Prefixx supports the full deployment process for teams who chose to go with BYOIP. The BYOIP approach ensures that your infrastructure retains the same public-facing addresses regardless of which provider or platform you migrate to.

Key terms in every BYOIP arrangement

Each BYOIP has a few simple documents associated with it. A prefix origin certificate (ROA) is a signed resource public key infrastructure (RPKI) document that binds an Autonomous System (AS) to a set of IP addresses with a maximum advertisement size in terms of prefix length to prevent more specific annoucements of a hijack. This cryptographic binding provides enhanced security by ensuring that only the authorized AS can legitimately announce the specified prefix.

An Internet Routing Registry (IRR) route object is typically associated with a ROA document. An RDAP record for a domain name proves AS number ownership at a registry. A BGP advertisement is sent as a announce message on the internet. These registry systems collectively form the authoritative infrastructure for internet numbers and their associated routing policies.

The LOA grants a third party permission to originate your IP prefixes, and your IP addresses can then be moved around, retain a good reputation and be fully managed in any cloud or network.

Frequently asked questions

What documents are needed to onboard your own IP addresses with cloud providers?

You will need a Letter of Authorization (LOA) authorizing the service provider to announce your address range prefix, along with proof of RIR registration for the block.

Can I use leased rather than own IP addresses with BYOIP?

Yes. Prefixx leases come with a non-revocation guarantee and include the full white-glove routing package: LOA, RPKI ROA, and IRR route objects. That means a leased block can be brought to a BYOIP-capable provider under the same process as an owned block. Lessees receive the same routing capabilities and documentation as those who own addresses outright.

How long does onboarding typically take when bringing your own IP addresses?

There is no single industry-wide timeline, because each cloud platform and infrastructure provider runs its own verification queue.

Does BYOIP work across all five RIR regions?

BYOIP is a routing mechanism for IP prefixes, not a registry policy, so it works with address space registered under any of the five RIRs: ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC. The practical constraint is whether your target provider accepts prefixes from a given region. Prefixx is a registered broker with ARIN, RIPE NCC, and APNIC, and facilitates LACNIC transfers, so it can handle the routing paperwork for blocks across all five regions.

What is the minimum IP addresses range size accepted for BYOIP?

The global routing table generally filters prefixes smaller than a /24, making a /24 (256 addresses) the practical floor for any announced prefix. Prefixx works with blocks from /24 up to /16, so any block sourced or leased through Prefixx meets that threshold.

Will my IP addresses reputation carry over when switching providers?

Yes, reputation travels with the address space, not with the infrastructure it sits on. That is precisely why Tixx quality control checks every block's address range for blacklist status, routing hygiene, and abuse history before it reaches a buyer or lessee. Prefixx also includes ongoing reputation monitoring across 12 DNSBLs for your address range, geolocation correction, and abuse complaint processing as part of the white-glove service, so you have visibility and remediation support after the block is live. The same reputation monitoring and remediation support applies equally to onboarded IPs whether they were purchased outright or leased through the platform.

What is the difference between a ROA and an LOA in a BYOIP arrangement?

A ROA (Route Origin Authorization) is a cryptographically signed RPKI object that tells the global routing system which ASN is authorized to originate your bring your own IP prefix's address range.

Both are required for a complete BYOIP setup covering your address range within a cloud infrastructure: the ROA protects against route hijacking at the routing-protocol level, while the LOA satisfies the provider's compliance and contractual requirements.

BYOIP enables portability while maintaining full control over your IP address space, your IP reputation history, your geolocation data, and your IP routing policy. The block of IP addresses must be of minimum size and pass a simple validation test by your new provider.

If you are working with an IP address range or block you already own, Prefixx prepares every routing document on your behalf and handles BYOIP deployment onto Netrouting bare metal as part of the deal. If you still need to acquire a clean, transfer-ready block, Tixx quality control runs on every listing before it reaches you. Contact the Prefixx team to confirm your block qualifies and to get the process started.