What is mntner?

A mntner (maintainer object) is the RPSL object in an Internet Routing Registry that holds the credentials allowed to create, change or delete other objects.

Every object in an IRR, whether a route, aut-num, as-set or inetnum, lists one or more maintainers in its mnt-by attribute. When someone submits a change, the registry checks that they can authenticate as one of those maintainers; if not, the update is refused. The mntner itself carries auth attributes describing how to authenticate, such as a hashed password or a PGP key fingerprint, depending on what the registry supports; the RIPE Database also accepts its single sign-on accounts. A maintainer is normally protected by itself, with its own name in its mnt-by, so only its holders can change its credentials. Related attributes give finer control: mnt-lower on an address block says who may create more-specific objects inside it, and mnt-routes says who may create route objects for that space.

In practice the mntner is how a network keeps strangers from editing its routing data. If your AS-SET or route objects are protected only by a shared password that has leaked, or by a maintainer belonging to a former employee or old provider, someone else may be able to change what your neighbours' filters accept. Good practice is to use strong authentication, keep the maintainer's contact details current and check which maintainers protect your objects from time to time. The authorisation checks between maintainers are what make an authoritative registry meaningful: in the RIPE Database, a route object needs the agreement of the address space's maintainer. In non-authoritative registries those checks are weaker, which is part of why RPKI is used alongside them. The IRR, RPSL and AS-SETs lesson shows maintainers alongside the other RPSL objects.