Skip to content

DigitalOcean BYOIP Integration Overview

BYOIP SUPPORTER
ASN AS393406
IPv4 support
IPv6 support
LOA support
ROA support
Process Semi-automatic
Locations supported
Other: India, Singapore, Germany, Netherlands, United Kingdom, Canada, United States, Australia

This page outlines the technical and procedural information required for integrating Bring Your Own IP (BYOIP) with DigitalOcean’s cloud infrastructure. DigitalOcean’s BYOIP feature lets you bring your own IPv4 network prefixes, provision them as Reserved IP ranges, and assign those addresses to Droplets using the same control panel, API, and CLI you use for standard Reserved IPs.

Provider Details

FieldInformation
Provider NameDigitalOcean
WebsiteHow to Provision a BYOIP Prefix | How to Assign BYOIP IPs | Reserved IP & BYOIP Features
ASN(s)Primary network ASN: AS14061 (DigitalOcean network).
BYOIP origin ASN for ROAs: AS393406 (must be authorized as origin in your RPKI ROA).
Regions SupportedBYOIP is implemented on top of Reserved IPs. Reserved IPv4 (and therefore BYOIP) is available in all DigitalOcean datacenters. DigitalOcean currently operates 13+ datacenters across nine regions (for example NYC, SFO, TOR, LON, FRA, AMS, SGP, BLR, SYD). See Reserved IP Availability and Regional Availability.
Support ContactSupport Center & Tickets | Contact / Sales | Report Abuse
Tech Article & DateHow to Provision a BYOIP Prefix (Docs, validated Sept 2025) & BYOIP GA noted in Reserved IPs release notes (GA on 18 Sept 2025). See also product update blog: “Announcing per-sec billing, new Droplet plans, BYOIP, and NAT gateway preview” (Oct 2025).
BYOIP ScopeProvider-announced IPv4 prefixes only: you bring your own IPv4 prefix (/24–/18), create an RPKI ROA that authorizes AS393406 as origin, and DigitalOcean announces the prefix from the selected datacenter. Once provisioned, addresses are exposed as Reserved IPs assignable to Droplets via the standard Reserved IPs interface.
Supported VersionsIPv4 only for BYOIP. Supported network sizes from /24 (256 addresses) to /18 (16,384 addresses). Reserved IPv6 is supported as a separate feature, but BYO-IPv6 is not currently documented.
Supported ServicesBYOIP prefixes are exposed as Reserved IP ranges and can be assigned to Droplets only. Reserved IPs (including BYOIP addresses) are region-specific and can only be attached to Droplets in the same datacenter. Reserved IPs are not supported directly on DigitalOcean Kubernetes worker nodes or load balancers; you typically use Droplets as the attachment point.

Technical Requirements

RequirementDetails
Prefix SizeBYOIP currently supports IPv4 only, with network sizes from /24 (256 addresses) to /18 (16,384 addresses). Smaller than /24 or larger than /18 is not supported. IPv6 BYOIP is not documented; IPv6 is supported only via standard Reserved IPv6 addresses.
ASN Ownership RequiredNo customer ASN required. DigitalOcean originates your IPv4 prefix on its own infrastructure. You must create an RPKI Route Origin Authorization (ROA) that lists ASN 393406 as the authorized origin ASN for the prefix.
IRR / Route ObjectsIRR / RADb route objects are not explicitly required in the documented flow. Proof of control is based on:
• An X.509 certificate you generate and embed into your prefix’s RIR RDAP/WHOIS records, and
• A valid RPKI ROA authorizing AS393406.
DigitalOcean validates ownership via these cryptographic and registry records.
ROA or LOAROA required. You must configure a Route Origin Authorization (ROA) at your RIR for the prefix, authorizing AS393406 as origin.
LOA: Not mentioned in the official docs; the process is based on RIR records + X.509 certificate + ROA rather than a traditional LOA.
RIR LimitationsYour IPv4 prefix must be registered with one of the five RIRs: ARIN, RIPE NCC, APNIC, AFRINIC, or LACNIC. You must have direct control and update authority for the prefix’s RIR records, including the ability to add RDAP remarks/description fields and to create/manage the RPKI ROA.

Step-by-Step BYOIP Process

Estimated Setup Time: Provisioning requests are reviewed within up to 7 days after submission, plus normal BGP propagation once advertisement is enabled.

Tested By Us: Not yet

A) BYOIP provisioning (bringing your IPv4 prefix into DigitalOcean)

  • Request BYOIP access from the Reserved IPs page in the DigitalOcean control panel (Networking → Reserved IPs → Request access).
  • Verify you control an IPv4 prefix (/24–/18) at a supported RIR (ARIN, RIPE, APNIC, AFRINIC, LACNIC) and can edit its RDAP/WHOIS records.
  • Generate a private ECC or RSA key and X.509 certificate with openssl, then base64-encode the certificate into a single-line value for use in RIR records.
  • Embed the encoded X.509 certificate into your prefix’s RIR records (for example APNIC descr, ARIN public comments, RIPE/AFRINIC/LACNIC RDAP remarks) and verify with the rdap tool that it appears under the prefix.
  • Create an RPKI ROA for the prefix at your RIR that authorizes ASN 393406 as the origin for the /24–/18 you intend to bring into DigitalOcean.
  • Use doctl or the API to generate a signed message, sign it with your private key, base64-encode the signature, then call doctl network byoip-prefix create or POST /v2/byoip_prefixes with prefix, region slug (for example nyc3), and signature. Wait for DigitalOcean to review (up to 7 days) and mark the prefix Active.

B) Assigning and managing BYOIP IPs as Reserved IPs

  • After the prefix status becomes Active, enable advertisement (set advertise: true) via the control panel, doctl network byoip-prefix update, or the /v2/byoip_prefixes API so the prefix is announced to the Internet.
  • In Networking → Reserved IPs, BYOIP ranges appear alongside standard Reserved IPs. Use the UI, doctl compute reserved-ip-action assign, or reserved IP APIs to assign specific BYOIP addresses to Droplets in the same datacenter.
  • Respect platform limits: only IPv4 is supported; the first two IPs of each BYOIP subnet are reserved; and each Droplet can have at most one Reserved IP or BYOIP address attached at a time.
  • Update DNS and application configuration to use the new BYOIP addresses, and monitor reachability and routing (e.g. via third-party looking glass / BGP tools) as the prefix propagates.
  • If you later retire the range, unassign any BYOIP addresses, disable advertisement, and deprovision the BYOIP prefix via doctl or the /v2/byoip_prefixes API.

References: How to Provision a BYOIP Prefix, How to Assign BYOIP IPs, Reserved IP Features (BYOIP section), Reserved IP & BYOIP Limits.

Cost and Limitations

ItemDetails
FeesReserved IPs (including BYOIP addresses) are free when assigned to a Droplet. Unassigned Reserved IPv4 addresses cost per hourly basis.
Bundled or StandaloneBYOIP is fully integrated with the Reserved IPs feature. BYOIP prefixes use the same control panel, API, CLI, pricing model, and limits as standard Reserved IPs; there is no separate BYOIP SKU.
Traffic/Peering RestrictionsReserved IPs and BYOIP addresses are region-specific resources and can only be assigned to Droplets within the same datacenter. Each BYOIP prefix is bound to a single datacenter; multi-region announcement of the same prefix from multiple locations is not documented. Only Droplets can receive BYOIP addresses; reserved IPs (including BYOIP) cannot be attached directly to Kubernetes worker nodes or load balancers.
Other LimitationsBYOIP supports IPv4 only, prefix sizes /24–/18. The first two IP addresses in each BYOIP subnet are reserved by the platform and cannot be assigned. A Droplet can have at most one Reserved IP or BYOIP address. BYOIP prefixes can only be assigned within the chosen datacenter and cannot be moved between regions without reprovisioning and coordination with DigitalOcean. Maintaining valid RPKI ROAs and RIR RDAP certificate records is required for ongoing service.

Automation & Developer Access

  • API Access: Yes — BYOIP prefixes are provisioned and managed via the DigitalOcean API (for example, POST /v2/byoip_prefixes and related endpoints), while assignment and management of individual addresses use the standard /v2/reserved_ips actions.
  • CLI: doctl network byoip-prefix (create, list, update, delete BYOIP prefixes) and doctl compute reserved-ip-action assign for attaching specific BYOIP addresses to Droplets.
  • Terraform: Official DigitalOcean Terraform provider (e.g. digitalocean_droplet, digitalocean_reserved_ip) can be combined with API-driven BYOIP provisioning for fully automated infrastructure workflows.
  • SDKs: pydo (Python client), @digitalocean/dots (TypeScript client), and community SDKs in multiple languages can be used to script BYOIP prefix lifecycle and Reserved IP assignments.

Abuse & Reputation Management

  • DigitalOcean requires an RPKI ROA that authorizes ASN 393406 as origin and monitors BYOIP announcements. If network operations detect anomalies and they are not remediated within one business day, DigitalOcean may withdraw the BYOIP prefix from their advertisements.
  • Abuse reports (e.g. phishing or spam from your BYOIP addresses) are handled through the Report Abuse form; ongoing IP reputation monitoring and any blacklist delisting remain the customer’s responsibility.

DigitalOcean Homepage
Reserved IPs Overview & Release Notes
How to Provision a BYOIP Prefix
How to Assign BYOIP IPs
Reserved IP & BYOIP Features
Reserved IPs & BYOIP Pricing
Reserved IP Availability
Reserved IP & BYOIP Limits
doctl network byoip-prefix Reference
pydo.byoip_prefixes API Reference
Product Update Blog: BYOIP & NAT Gateway

FAQ

BYOIP, or Bring Your Own IP, is a service that enables organizations to bring their own public IP addresses—whether owned outright or leased from an IP provider—into a service provider’s network infrastructure. Instead of relying on IP addresses assigned by the provider, BYOIP allows businesses to retain control over their IP resources. This ensures continuity, particularly for organizations with established IP-based reputations, branding, or dependencies on specific address blocks. IP providers can assist in streamlining this process, making it easy to integrate your IPs into the desired network environment.

BYOIP offers several compelling advantages. By using your own IPs, you can maintain continuity in your network’s identity, reduce the risk of disruptions to email deliverability or service recognition, and avoid reputational concerns associated with shared IPs. Additionally, BYOIP provides enhanced flexibility and control over your IP resources.

BYOIP is ideal for organizations that either own public IP addresses or lease them from a trusted IP provider with explicit BYOIP support. This includes enterprises, cloud providers, content delivery networks (CDNs), and businesses with compliance requirements or IP reputation needs. Working with a reputable IP provider ensures that leased IPs can be seamlessly integrated into another provider’s infrastructure without ownership concerns.

You must either legally own the IP addresses or have explicit authorization from a leasing IP provider to route and manage them. IP providers who offer BYOIP-ready IP addresses simplify this process, providing documentation and support to ensure compliance with regional internet registry (RIR) policies and service provider requirements. This collaboration ensures smooth implementation without any legal or operational issues.

To use BYOIP, you’ll typically need to present documentation verifying your authority over the IP block. This can include official records from a regional internet registry (RIR) such as ARIN, RIPE NCC, or APNIC. If you are leasing IPs, the IP provider should supply proof of their ownership and grant you permission for BYOIP. Providers that specialize in IP leasing often handle this paperwork for you, reducing administrative burden and ensuring compliance.

Yes, BYOIP is designed to be a secure and reliable solution. Reputable service providers and IP providers implement robust safeguards to prevent unauthorized use or hijacking of IP addresses. Security measures include BGP filtering, route validation, and advanced protocols like Resource Public Key Infrastructure (RPKI). By collaborating with a trusted IP provider, businesses can benefit from additional layers of protection, ensuring that only authorized traffic is routed through their IP blocks.

The setup process for BYOIP varies by provider, typically taking anywhere from a few hours to a few days. Factors include the complexity of your network, the verification process for IP ownership or authorization, and the time needed for global BGP route propagation. IP providers often expedite the preparation and validation stages, ensuring a smooth and timely integration into the desired infrastructure.

Absolutely. Many providers, in partnership with IP providers, support routing IPs across multiple data centers or geographic regions. This feature optimizes performance for global businesses by reducing latency and improving service availability. When working with an IP provider, you can also ensure that your leased or owned IPs are aligned with your geographic requirements for compliance and efficiency.

If you choose to discontinue BYOIP with a provider, your IP addresses will be released from their network, and routing will cease. You can then reallocate these IPs for use with a different service provider or project.