For organisations that want to keep their own LIR

Managed LIR

You keep the RIPE NCC membership, the legal ownership and the General Meeting voting rights. We handle everything else: portal administration, database object maintenance, sub-allocations to your downstream customers, annual audit responses, RPKI infrastructure, abuse reports and first-line support. Your LIR stays yours, but your team stops running it on the side.

Request a scoped quote What's in scope?
Pricing model
Custom, scope-based
We price per LIR size, resource count, number of sub-allocations and support tier. Typical engagements run from a few hundred EUR/year for small LIRs to enterprise contracts for multi-resource ones.
  • Fixed annual fee, no hourly billing
  • Month-to-month & annual contracts
  • No handover fee when you leave
  • NDA-friendly engagement
Who is this for

When keeping your own LIR matters, but operating it does not

Hosting providers and ISPs that need PA sub-allocations to downstream customers and want to present as an independent LIR, without hiring a full-time RIPE operator.

Enterprises with large portable holdings, /29 IPv6, multiple ASNs, legacy PI, where RIPE membership is easier to justify than delegating to a third-party sponsor, but dedicated in-house operations are overkill.

Organisations under regulatory pressure that need the direct RIPE NCC contractual relationship (for due diligence, audit trail, KYC continuity) but do not want the operational burden of maintaining RPKI CAs, audit responses and sub-allocation documentation in-house.

Acquiring companies that have inherited a dormant LIR from an M&A and need it kept compliant until strategic decisions (merge, wind down, continue) are made.

What you keep as the LIR
  • RIPE NCC membership & legal ownership
  • General Meeting voting rights
  • Full control of downstream relationships
  • Brand: your LIR name in WHOIS, not ours
  • Strategic decisions (sub-allocation policies, pricing)

Professional Certifications

Our team consists of RIPE NCC certified professionals, with expertise in IPv6 network design, BGP security, RIPE Database management, and Local Internet Registry operations. We provide reliable, high-quality services to help organizations plan, implement, and secure their networks according to globally recognized best practices.

Local Internet Registry

Local Internet Registry

Proficient in managing Internet number resources, including requests, distributions, registrations, and stakeholder coordination.

Verify Certification
IPv6 Fundamentals Analyst

IPv6 Fundamentals

Certified to plan and implement IPv6 networks, calculate subnets, create addressing plans, and transition from IPv4 to IPv6.

Verify Certification
RIPE Database

RIPE Database

Certified in RIPE Database operations, including searching, interpreting, updating, and managing IP assignments and routing policies.

Verify Certification
BGP Security

BGP Security

Qualified to assess BGP security risks, implement route validation with RPKI, and secure Internet routing against hijacks and leaks.

Verify Certification
IPv6 Security Expert

IPv6 Security

Expert in designing secure IPv6 networks, analyzing threats, and applying advanced strategies to protect against emerging vulnerabilities.

Verify Certification

What we take off your hands

Every Managed LIR engagement is scoped individually, but these are the workstreams we cover most of the time.

RIPE Portal operation

We operate your RIPE Portal with delegated credentials: submit updates, handle Resource Transfer, respond to RIPE NCC correspondence, keep billing and org details current.

Database object maintenance

All your inetnum, inet6num, aut-num, org, mntner, person, role and abuse-c objects are kept up to date and cross-referenced.

Sub-allocations to your customers

PA assignments, customer inet6num creation, SWIP-style updates, assignment windows tracked against your RIPE policy justification.

RPKI signer + validator hosting

Delegated CA under your organisation, ROA signing pipeline, HA validators for your network, router config snippets, ROA audit on changes.

Annual audit response

We prepare the Assisted Registry Check file, justify assignments, supply sub-allocation documentation, and answer RIPE Registration Services questions in your name.

Abuse contact & first-line support

Staffed abuse-c mailbox with triage and escalation playbook. Optional first-line support for your downstream customers, branded as your LIR.

Get a scoped Managed LIR proposal

Share your resource inventory and operational requirements. We return a fixed annual quote and a draft runbook within three business days.

Request proposal Email us

Not sure Managed LIR is the right fit?

LIR Sponsoring
We become your sponsor
BGP Services
Network operation on top
All LIR Services
See the full menu

Managed LIR FAQ

Common questions from operators evaluating managed LIR operations.

How is Managed LIR different from LIR Sponsoring?
With Sponsoring we become the RIPE NCC sponsor of your resources, you do not have your own LIR. With Managed LIR, you remain the LIR (with membership, voting rights, ownership) and we operate the backend on your behalf. Sponsoring is simpler and cheaper; Managed LIR keeps you independent and visible on RIPE.
Whose name appears in WHOIS and on the RIPE member list?
Yours. Your LIR name remains the sponsoring party on all your resources, and your organisation stays on the public RIPE NCC member list. We operate as a delegated administrator, invisible on public records.
Do we have to give you RIPE Portal credentials?
You grant us a delegated admin role in the Portal with a limited permission scope. You can see every action we take in the audit log and revoke the delegation at any time. We do not need your root credentials.
Can you co-exist with our in-house network team?
Yes. Most engagements are co-managed: we handle the RIPE administrative surface, your team runs the network. We publish a clear RACI at onboarding so there is no ambiguity about who does what.
What happens during the annual RIPE audit?
We lead. We prepare the Assisted Registry Check file, compile assignment documentation, respond to RIPE Registration Services questions in your name and escalate to you only when a question requires your direct input (strategy, legal entity changes). Audits typically close in 2-3 days of calendar time.
How is pricing determined?
We scope based on four factors: number of resources under the LIR, number of sub-allocations (customers you assign to), support tier desired (business hours vs. 24/7), and whether you want abuse-c mailbox handling. We quote a fixed annual fee, not hourly billing.
Can you run our RPKI Delegated CA?
Yes. We deploy and operate a Delegated RPKI CA under your organisation, sign ROAs in a HA pipeline, and optionally provide two validator instances for your routers. This keeps your ROAs under your root of trust rather than RIPE's hosted service.
What if we want to move to another provider or bring ops in-house?
We hand over cleanly: RIPE Portal delegation revoked, RPKI CA migrated to your chosen host, runbooks delivered. Since you own the LIR, there is nothing to transfer contractually, only the operational relationship ends. No exit fee.
Do you support white-label downstream billing?
Optionally. We can invoice your downstream customers in your name for the sub-allocations they hold, or leave billing entirely to your side. We find most LIRs prefer to keep billing in-house and only delegate the RIPE Database operations.
Is there a minimum LIR size for Managed LIR?
No hard minimum. We engage with LIRs that have as little as a single IPv6 /29 and one ASN, and with LIRs running thousands of sub-allocations. The pricing model scales accordingly.
How long does Managed LIR onboarding take?
A fresh engagement typically takes 5-10 business days. We collect your legal entity info, sign the delegated admin agreement, inventory existing resources, audit current RIPE objects for gaps, migrate RPKI keys if you want us to host the CA, and document the handover runbook. Your routing never changes during onboarding.
How do sub-allocations to our own customers work?
You open a ticket (or API call) with the customer details and prefix size. We create the inet6num with status ASSIGNED PA, set up mnt-by and mnt-domains, register the customer organisation and role objects, and hand back the RIPE whois link. Turnaround is under 2 hours during business hours.
Who handles abuse reports for our prefixes?
Your choice. Option A: your team keeps the abuse-c mailbox and we only maintain its registration. Option B: we operate a monitored abuse mailbox with triage, auto-ack, and escalation rules that match your content policy. Most LIRs with more than 50 downstream customers take option B.
What is the SLA on RIPE Database operations?
Standard tier: 4 business hours for creates and updates, 8 business hours for new sub-allocations, 1 business day for LIR Portal operations that require RIPE review. Business-critical tier: 1 hour for emergency updates, 24/7 coverage, named contact. SLA is written into the contract.
How do you secure our LIR Portal access?
Every operator uses hardware-backed MFA (YubiKey or equivalent) and least-privilege RIPE roles. Access is logged in both the RIPE audit trail and our internal SIEM. On your side, the delegation can be revoked instantly from your Portal dashboard; revocation takes effect in under 60 seconds.
Can you run reverse DNS and delegations for our prefixes?
Yes. We host authoritative reverse DNS (ip6.arpa) for your allocations on anycast infrastructure and delegate sub-ranges to your downstream customers on request. Reverse updates are API-driven, so automation in your portal can trigger changes in seconds.
Do you maintain our AS-SET and route objects?
Yes. We keep as-set, route and route6 objects current as your customer base changes. Every onboarded downstream gets added, every removed one gets deleted promptly. Since IXP route servers and tier-1 transits filter off these objects, keeping them fresh prevents silent dropped announcements.
Is support available in Romanian and English?
Both. Our operations team handles tickets, phone calls and incident bridges in either language without handoff delay. Contracts can be executed in Romanian, English, or dual-language at no extra cost.
How are fees invoiced and what payment terms apply?
Annual sponsorship fees invoiced in EUR, net 30, by bank transfer or card. For Managed LIR contracts over 36 months, we offer a 5% discount paid upfront or a quarterly installment schedule. All invoices are legal-entity compliant for Romanian and EU VAT rules.
What happens to our resources if DreamServer shuts down?
The contract mandates a 90-day continuity window during which we transfer the RPKI CA, delegation, runbooks and downstream contacts to a successor operator of your choosing. Because you own the LIR membership directly with RIPE NCC, no resource is ever at risk of being re-allocated; operational ownership can move to another provider in days, not months.

Trusted By & Member Of

We are proud members of leading internet infrastructure organizations.

RIPE NCC MANRS PeeringDB RoTLD DSIX SBIX 4IXP LOCIX Euro-IX RIPE NCC MANRS PeeringDB RoTLD DSIX SBIX 4IXP LOCIX Euro-IX