DigitalOcean BYOIP: bring your own IPv4 addresses to Droplets

You prove control of the prefix with a certificate in its registry record and a message signed with the same key. After DigitalOcean's review, the addresses work like reserved IPs.

What DigitalOcean accepts

From DigitalOcean's documentation, on the day we checked:

• Access. BYOIP sits behind a Request access link at the bottom of the Reserved IPs page in the Control Panel.
• Size. A /24 to a /18, IPv4 only. The first and second addresses of the prefix are reserved, so a /24 gives you 254.
• Registry. ARIN, the RIPE NCC, APNIC or one of the other regional registries. DigitalOcean says nothing about PA, PI or legacy space; it asks that you can log in to the registry and update the prefix's public records.
• Who originates. DigitalOcean, from AS393406.
• Where. Any data center, but one per prefix: the addresses can only be assigned to resources in the data center you choose.
• What uses it. Droplets, one BYOIP or reserved IP each at a time. External regional load balancers and public NAT gateways take a BYOIP address only when you create them, and it cannot be changed later.
• Price. "Provisioning BYOIP address blocks and using BYOIP addresses is free." Data transfer is billed as Droplet bandwidth.
• Timing. "Expect a response within seven business days."

Before you start

A ROA for AS393406. It must allow the prefix to originate from DigitalOcean's AS393406, and your registry can host it (RPKI and ROAs). DigitalOcean does not specify a maximum length. Keep the ROA of any network that announces the block today until you switch.

A key pair and a certificate, made with OpenSSL. DigitalOcean's example uses an ECC P-384 key and also accepts RSA:

openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:P-384 -out private_key.pem
openssl req -new -x509 -key private_key.pem -days 365 -out x509_certificate.pem
cat x509_certificate.pem | tr -d "\n" > encoded_x509_certificate.pem

The certificate in the registry record, on one line. DigitalOcean reads it over RDAP, where it must appear under IP Network, Remarks, Description. The field you edit depends on the registry:

At the other registries, use whichever field RDAP shows under Remarks, Description. rdap 203.0.113.0/24 shows whether the certificate is there. DigitalOcean's page asks for no letter of authorization and no route object.

Tools. doctl, openssl and rdap on a Unix command line.

Step by step

01Request access from the Reserved IPs page, before anything else.

02Sign the provisioning message. It names your team's UUID, which doctl account get -o json shows under team, and the prefix:

echo -n "DO|<team_uuid>|203.0.113.0/24" | openssl dgst -sign private_key.pem -keyform pem -sha256 -out signature_file.txt
cat signature_file.txt | openssl base64 | tr -- '+=/' '-_~' | tr -d "\n" > encoded_signature_file.txt

03Submit the request for one data center region:

doctl network byoip-prefix create --prefix 203.0.113.0/24 --region ams3 \
  --signature "$(cat encoded_signature_file.txt)"

In the Control Panel, the same request is Networking, Reserved IPs, Add your own IP prefix, which also asks for a project.

04Wait for the review. The prefix shows Provisioning, then Active. doctl network byoip-prefix get <prefix-id> reports in_progress until it is done.

05Advertise. A new prefix is not announced until you switch it on:

doctl network byoip-prefix update <prefix-id> --advertise=true

06Assign addresses. To Droplets as you would reserved IPs. For a load balancer or NAT gateway, pass the address with --ip when you create it (doctl 1.165.0 or later); the prefix must be Active and advertised in the same region.

Mistakes that cost a day

• A ROA for the wrong DigitalOcean ASN. ARIN's registry lists several AS numbers for DigitalOcean, AS14061 among them. The BYOIP page names AS393406 only.
• An Active prefix nobody can reach. Provisioning does not announce the prefix. Until you set advertise to true, no traffic arrives.
• An announcement problem left until tomorrow. DigitalOcean contacts you if it sees an anomaly in your prefix's announcement. If the problem is not fixed within one business day of its start, "irrespective of your responsiveness", DigitalOcean ends BYOIP for that prefix and withdraws it.
• Load balancer and NAT addresses are fixed. They are set at creation, and global and internal load balancers cannot use BYOIP at all.
• Pages that lag. The limits page, last updated 13 July 2026, still says BYOIP addresses can only be assigned to Droplets. The how-to pages of 3 September 2026 add load balancers and NAT gateways.
• Mail and reverse DNS. The limits page says SMTP ports 25, 465 and 587 are blocked and PTR records unsupported on reserved IPs, and does not say whether either applies to BYOIP addresses. Ask before you move a mail server.

If you lease the block

DigitalOcean's prerequisites are written for the registrant: "direct control and update authority" over the block, and a login at the registry. With leased space, the holder makes the registry changes: the certificate in the record, which only the holder's maintainer can edit, and the ROA for AS393406. You make the key and the certificate, send the holder the certificate, and keep the private key to sign the request from your own account. DigitalOcean's pages do not say whether it accepts records that a holder edits for you, so mention the lease when you request access.

Where RTM Networks fits

We lease /24s and larger from our own RIPE NCC address space, and sell blocks in the RIPE NCC, ARIN and APNIC regions. For space leased from us, we add your DigitalOcean certificate to the registry record and create the ROA for AS393406, so the request itself is all that is left in your account (lease IPv4). If you need fewer than 256 addresses on a Droplet, we announce a block and deliver the addresses over GRE or WireGuard, down to a single one (GRE and WireGuard tunnels). Other providers: BYOIP guides.