Managing IPv4 Address Strategy for Growing Businesses

Apr 28 2026

Managing IPv4 Address Strategy for Growing Businesses

I pulled up our cloud bill last quarter and noticed a line item that did not exist two years ago, public IPv4 charges. AWS now bills $0.005 per public IPv4 address per hour, and across staging, production, and dev environments, those small charges added up fast.

That single line item forced a conversation more U.S. businesses are now having. Should you keep renting IPv4 from cloud providers, or should you acquire your own block and move it wherever you need it?

IPv4 scarcity is not new. The real change is cost pressure. Native IPv6 usage surpassed 50% of global Google service access on March 28, 2026, yet most business-critical dependencies, partner IP allowlists, email reputation, and legacy API callbacks still rely on IPv4. You cannot just skip it.

The hard part is not finding a block. The hard part is sizing it, proving need, checking reputation, and making it usable across cloud and on-prem networks without creating routing or email problems.

Use this as a working checklist before your first transfer.

Key Takeaways

The decision gets easier when you size the block correctly, understand transfer policy, and plan operations before you wire money.

  • A /24 is your practical floor. It is the minimum IPv4 transfer size at ARIN and the smallest prefix that propagates reliably across the global routing table. Routes more specific than /24 are commonly filtered, so plan purchases in /24 increments.
  • ARIN recipients must justify 24 months of need. Source entities generally must not have received IPv4 from ARIN in the prior 12 months. In the RIPE region, transferred space carries a 24-month hold before re-transfer, which affects liquidity and timing.
  • Market prices have softened. Mean sale prices reached roughly $22 per address in early 2026, with lows near $9 per IP for large blocks. Leasing commonly clears at $0.38 to $0.50 per IP per month.
  • Cloud IPv4 charges change the math. AWS charges $0.005 per public IPv4 per hour. Bring Your Own IP, or BYOIP, lets you use owned space inside AWS, Azure, and GCP, which reduces recurring exposure and keeps addressing consistent.
  • Clean transfers close in two to four weeks. Parallel buyer pre-approval, seller validation, and escrow can shorten the cycle. Build slack for due diligence, sanctions screening, and RPKI setup.
  • Due diligence is not optional. Verify ownership through RDAP, check Spamhaus blocklists, review BGP route history, and plan geolocation corrections through MaxMind before production cutover.

What You’re Actually Buying

You are buying control and registration rights, not physical property.

You are not purchasing real estate. You are acquiring the right to have IP number resources registered to your organization and routed under your ASN, or Autonomous System Number, under Regional Internet Registry policy.

U.S. buyers work mainly under ARIN, the American Registry for Internet Numbers. ARIN’s RDAP and Whois services provide the authoritative record of who holds a block. That registry data supports RPKI, the Resource Public Key Infrastructure, IRR route objects in the Internet Routing Registry, and the routing checks upstream providers use before they accept your announcements.

Think of it like a domain name. You control it as long as registration stays current and you follow policy. That distinction matters because it affects every step of the transfer, from pre-approval paperwork to post-transfer Route Origin Authorization, or ROA, publication.

Three Reasons Businesses Still Buy IPv4 in 2026

Dedicated IPv4 still solves problems that IPv6 alone does not fix.

Even with IPv6 crossing the 50% usage mark, businesses still need stable IPv4 reachability for customer traffic, partner integrations, and cloud operations.

1. Customer and Partner IPv4 Dependencies

SaaS callback URLs, single sign-on integrations, partner IP allowlists, and legacy APIs still assume IPv4 endpoints. Dropping IPv4 reachability can break real workflows, delay onboarding, or force partners to rewrite systems they do not plan to touch this year.

2. Cloud IPv4 Cost Pressure

AWS began charging $0.005 per public IPv4 address per hour on February 1, 2024. The EC2 Free Tier offsets 750 hours per month for the first 12 months, but after that, cost scales with every extra public address. Owning a block and using BYOIP turns part of that recurring expense into a one-time capital outlay with resale value.

3. Email Deliverability and Reputation Control

Owning address space lets you warm sending IPs on your schedule, build a long-term sender reputation, and maintain clean reverse DNS, or rDNS. Shared cloud IPs can carry someone else’s spam history, and cleaning that up after launch is far harder than starting with known space.

Plan the Block Size Around Routing Realities

Start with routing rules, then map the block to actual service demand.

Start at /24 and expand in powers of two as your needs grow. IPv4 routes more specific than /24 are commonly filtered on the public internet, which makes /24 the practical minimum for broad propagation and the floor for ARIN transfers.

A /24 gives you 256 addresses and fits a small SaaS edge, mail infrastructure, or a few public service pools. A /23 at 512 addresses fits an MSP running multi-tenant NAT with dedicated IP pools. A /22 at 1,024 addresses suits a regional ISP, WISP, or a business that wants room for cloud, mail, and disaster recovery without renumbering next year.

Count by public-facing use cases, not just by server count. Load balancers, failover pairs, NAT gateways, isolated environments, and clean mail IP pools all consume space. Keep growth contiguous when possible because aggregated announcements are easier to manage and less likely to trigger prefix-length filters downstream.

Buy vs. Lease vs. Re-Architect

Treat IPv4 as a total-cost decision over 24 to 36 months.

  • Buy: CapEx, ~$5,600 one-time at $22/IP, resalable asset, longer lead time.
  • Lease: OpEx, ~$2,300–$3,070 total, faster start, no residual value.
  • Re-Architect: Engineering time, varies, reduces IPv4 need, rarely removes it.

Leasing can be cheaper across the first 12 months, and sometimes the first 24. Beyond that, asset value and control usually push the case toward buying. Re-architecting with dual-stack, plus NAT64 and 464XLAT where it fits, can reduce hard IPv4 demand, but it will not remove dependencies like email, partner allowlists, or third-party callbacks.

A mixed strategy is common. Lease for a short-term launch, buy for stable long-term pools, and re-architect internal services so future growth lands on IPv6 first.

Know the Gatekeepers: ARIN Transfer Rules

Policy, not price alone, determines whether a transfer can close.

ARIN’s Number Resource Policy Manual governs U.S. transfers. Recipients must document at least 50% utilization within 24 months, and the minimum transfer size is a /24 under NRPM section 8.5. In practice, that means you need a clear deployment plan, not a vague claim that you might need space someday.

Source entities generally must not have received IPv4 from ARIN in the 12 months before transfer approval under NRPM 8.3 and 8.4, with limited exceptions for entities under common control. If the seller’s chain of title is messy, expect delays while ARIN verifies corporate history and authority to transfer.

Inter-RIR transfers under section 8.4 require approval from both registries, which adds time and paperwork. In the RIPE region, recipients of IPv4 by allocation or transfer cannot re-transfer the same space for 24 months. If you are buying RIPE-registered space through an inter-RIR transfer, you still need to pass ARIN’s needs test on the receiving side.

Where to Source IPv4

The safest source is the one that reduces title, compliance, and reputation risk.

If your team wants a managed transaction, it helps to compare brokers on escrow support, compliance checks, title review, contract handling, seller screening, and how much ARIN or RIPE paperwork they manage for you during the transfer. For U.S. SMBs that would rather keep internal staff focused on routing, cloud onboarding, and BYOIP setup instead of contracts and transfer coordination, you can buy IP addresses through a broker-led process.

You have three main channels, and each one trades price against process support.

  • Brokers and marketplaces offer managed due diligence, standard contracts, and escrow coordination. They also help with ARIN paperwork, which matters if your team has never run an 8.3 or 8.4 transfer before. Fees often run from 5% to 15% of the transaction value.
  • Auctions provide clearer price discovery, but the timeline can be uneven. You may still need outside help for compliance checks, contract review, and post-transfer routing preparation.
  • Direct or private deals can lower fees, but they raise counterparty risk. Without a broker handling KYC, sanctions screening, and document collection, your team carries the full burden of verifying title and process.

A broker that supports escrow, seller screening, contracts, and ARIN transfer coordination can be useful when a small internal team needs to stay focused on routing, mail, and cloud onboarding instead of paperwork.

Due Diligence Checklist Before You Sign

Bad space is expensive space, even when the purchase price looks attractive.

Verify ownership, routeability, and reputation before funds move. Skipping one of these checks can create problems that take weeks to unwind after closing.

  • Ownership: Query ARIN’s RDAP endpoint for authoritative registration data. Confirm the holder name, Org-ID, and contact records match the seller’s claims and the party signing the contract.
  • Routeability: Confirm the block is at least /24. Review historical BGP visibility through looking glasses or RIPEstat to spot long outages, unusual path changes, or signs of a past hijack.
  • Reputation: Run the range through Spamhaus’s IP and Domain Reputation Checker for ZEN, CSS, and PBL datasets. Check additional DNSBLs as well, especially if you plan to send mail soon after cutover.
  • Geolocation: Review current geolocation records. After transfer, submit MaxMind geofeed and GeoIP Data Correction requests so the next database release reflects your network and country correctly.
  • Contract Terms: Ask for clean-title warranties, seller remediation obligations if blocklist issues appear, escrow release conditions tied to RIR approval, and sanctions representations from all parties.

Execute the Transfer

Clean transfers move fastest when legal, finance, and network workstreams run in parallel.

Typical well-documented transfers close in two to three weeks, though inter-RIR cases or messy ownership histories can stretch that to four weeks or more.

  • Obtain ARIN pre-approval by submitting your 24-month utilization plan and signing the RSA.
  • Execute an LOI and escrow agreement with milestone-based fund release.
  • Collect the seller’s due diligence package, including the LOA, reputation disclosures, and KYC or sanctions documents.
  • Have both parties open the ARIN 8.3 or 8.4 transfer ticket.
  • Wait for ARIN approval and confirm the registry record updates correctly.
  • Release escrow funds only after approval, then begin post-transfer operational work.

Post-Transfer: Day Zero to Day Seven

Move quickly after closing so the block becomes useful before it becomes a target.

Make the space usable and safe before production cutover. Unannounced space that suddenly appears in your registry record can attract hijack attempts, and delayed mail or DNS setup can stall a launch.

  • Publish RPKI ROAs that match your intended origin AS and an appropriate max-length before you announce the prefix in BGP, the Border Gateway Protocol.
  • Register IRR route objects in RADb or NTT and align them with your ROAs so your policy data and cryptographic origin data do not conflict.
  • Announce from a staging edge and validate propagation from multiple vantage points before you move production traffic or mail flows.
  • Update rDNS, add abuse contacts to your Org record, and set monitoring for hijack alerts and ROV, or Route Origin Validation, failures.
  • Submit geolocation corrections to MaxMind and other providers your customers rely on, then verify the changes in later database releases.

Bring Your Own IP to the Cloud

BYOIP is where owned space starts paying back operationally.

BYOIP reduces recurring cloud IPv4 charges and gives you consistent addressing across environments. That consistency matters for customer allowlists, vendor callbacks, firewall rules, and disaster recovery plans that should not change every time you move workloads.

  • AWS supports BYOIP for IPv4 prefixes down to /24. You prepare ROAs that authorize Amazon’s origin AS, integrate the range with VPC IP Address Manager, and then create Elastic IPs from the imported space.
  • Azure uses Custom IP Prefix. The global parent is usually between /21 and /24, and regional child ranges can be /22 to /26, advertised under Microsoft AS8075. Review regional design early so you do not strand usable addresses in the wrong geography.
  • Google Cloud uses a Public Advertised Prefix and a Public Delegated Prefix to validate ownership and route imported space. Commission timing and PTR delegation need advance planning because delays there can slow cutover for web, API, or mail systems.

Across all three providers, your ROAs and IRR objects must reflect the cloud provider’s origin AS before onboarding. Reverse DNS delegation and PTR record setup also take longer than teams expect, so start those requests early.

Make IPv4 Work Harder While You Adopt IPv6

Owned IPv4 is most valuable when you reserve it for the few places that truly need it.

Use dual-stack by default, then push new growth onto IPv6 wherever possible. NAT64, which lets IPv6-only clients reach IPv4 services, and 464XLAT, which translates traffic for mixed mobile and internal environments, can shrink your hard IPv4 requirement over time.

Move latency-tolerant public endpoints to IPv6-first behind a load balancer or CDN. Even if every customer is not ready, internal services and controlled partner links usually are. Track IPv6 user share each month so you know when you can reclaim IPv4 headroom, reassign clean pools, or eventually sell surplus space.

FAQ

These are the questions that most often slow down an IPv4 purchase.

What’s the Smallest Block I Can Buy and Still Route Globally?

A /24, which provides 256 addresses. It is the minimum transfer size at ARIN and the de facto smallest prefix that propagates reliably because most operators filter anything more specific.

How Long Does a Transfer Take?

Clean, well-documented cases typically close in two to three weeks. Inter-RIR transfers and blocks with complicated ownership history can take four weeks or more.

Is Leasing Cheaper Than Buying?

Usually across the first 12 to 24 months. After that, owned space has residual resale value and removes ongoing lease payments, which can make a purchase more cost-effective for long-term use.

Do I Need My Own ASN?

Yes, if you plan to announce the space directly through BGP. If not, an upstream provider can originate the prefix for you under a Letter of Authorization, though that gives you less routing control.

Should I Worry About RPKI?

Yes. Publish ROAs before your first BGP announcement. Networks that enforce Route Origin Validation will drop invalid routes, and ROV adoption keeps growing across transit providers and large networks.

How Do Cloud IPv4 Charges Change the Math?

They turn public IPv4 into a recurring operating cost. BYOIP offsets part of that charge by letting you use owned space in cloud environments, and pairing it with IPv6 migration reduces exposure further.

What About Email Deliverability on Newly Acquired Space?

Warm new sending IPs slowly, starting with low volumes to trusted recipients. Monitor Spamhaus and other blocklists daily during the first 30 days, and keep rDNS, SPF, DKIM, and DMARC correct from day one.

Ready to get started?

Tell me what you need and I'll get back to you right away.