ARIN IPv4 Exhaustion in 2026: Why Leasing a /24 Is Now the Practical Option for Hosting Companies

If your hosting company or SaaS operation needs a dedicated /24 subnet today, you have two realistic options: pay $20,000 or more on the secondary broker market for a permanent block with no support and no compliance documentation, or lease a clean, fully delegated /24 from a compliant provider for a fraction of that cost. For most operations, leasing is the correct choice — not because it sounds cheaper, but because the secondary market no longer offers the clean reputation, rDNS delegation, and RPKI coverage that production mail and hosting infrastructure actually requires.

The State of ARIN IPv4 in 2026

ARIN — the American Registry for Internet Numbers, which manages IPv4 allocation for the United States, Canada, and many Caribbean and North Atlantic territories — entered Phase 4 of its IPv4 exhaustion policy in 2015, when its free pool dropped below a /9. Since then, ARIN has operated a waitlist for organizations requesting new IPv4 space directly from the registry. As of 2026, that waitlist remains active, and new entrants typically wait months to years for even a small allocation — and only if returned or recovered space becomes available. ARIN's public waiting list documentation confirms that the registry will only fulfill requests as recovered IPv4 resources allow, with no guaranteed timeline.

This is not a temporary condition. The IANA free pool for IPv4 exhausted in 2011. Every Regional Internet Registry (RIR) — ARIN, RIPE NCC, APNIC, LACNIC, and AFRINIC — has now reached or passed its depletion point for new allocations. What remains circulates through transfers, broker sales, and leasing arrangements. New hosting companies, SaaS operators, and any organization launching email or multi-IP infrastructure in the ARIN region today cannot get a direct allocation from the registry in any practical timeframe.

The practical consequence is that a /24 block — 256 usable addresses, the minimum size most mail server operators and hosting providers need for clean, routable multi-IP infrastructure — is now a market commodity. You acquire it either by purchasing from a broker on the secondary transfer market or by leasing from a provider who holds registered ARIN-compliant space and sub-delegates it to you.

What a /24 Subnet Actually Needs to Do

Not all IPv4 blocks are equivalent. A /24 purchased cheaply from a grey-market broker, or sub-leased from an unregistered intermediary, can carry a poisoned reputation that takes years to remediate — if it can be remediated at all. Before evaluating cost, it is worth being precise about what production-ready /24 space actually requires.

Clean reputation and no blacklist entries. For email-sending infrastructure, a single Spamhaus or Barracuda listing on even a portion of the /24 will cause widespread delivery failures. Blacklist lookups operate at the /24 level, which means one bad range in your block can affect the reputation of adjacent addresses. Before any /24 is usable for outbound mail, it needs to be verified clean across the major blacklists: Spamhaus ZEN, SURBL, Barracuda, and UCEPROTECT.

Full rDNS delegation. Reverse DNS — the PTR record that maps an IP address back to a hostname — is required for outbound mail acceptance by most major receivers, including Google Workspace, Microsoft 365, and any MTA running basic anti-spam policy. For rDNS to work on your /24, the responsible RIR (in this case ARIN) must have a delegation record pointing to nameservers you control, or the provider must operate rDNS on your behalf under a proper sub-delegation. Without this, you cannot set PTR records for individual IPs in your block, and your mail infrastructure will fail basic sender checks regardless of how correctly you configure SPF, DKIM, and DMARC.

RPKI ROA coverage. Resource Public Key Infrastructure (RPKI) is the BGP security framework that allows a route origin authorization (ROA) to cryptographically validate that an ASN has the right to announce a given prefix. As of 2026, RPKI-invalid routes are increasingly dropped by major transit providers and IXPs. If your /24 does not have a valid ROA signed by the ARIN resource holder, your prefix may be filtered by upstream networks, making your addresses unreachable from parts of the internet. ARIN's RPKI documentation covers how ROAs are created and maintained.

BGP-4 routability. A /24 is only useful if it is announced via BGP. You need either your own ASN or a provider who will originate the prefix on your behalf under a Letter of Authorization (LOA). Many secondary market purchases leave the buyer responsible for finding their own transit and announcing their own prefix — which requires an ASN, transit agreements, and BGP configuration expertise that most hosting operators simply do not have in-house.

Leasing vs. Buying on the Secondary Market

The secondary IPv4 transfer market is real and legitimate. ARIN administers a formal transfer process, and IPv4 address blocks do change hands through registered brokers. However, the economics for a hosting company or SaaS operator in 2026 strongly favor leasing over buying for most use cases.

Secondary market pricing for a /24 has risen significantly as free pool exhaustion has deepened. As of late 2025 and into 2026, brokered /24 blocks trade in the range of $20 to $50 per IP address, making a 256-address /24 a $5,000–$12,800 acquisition at the lower end, and well over $20,000 at current median pricing depending on region and reputation quality.

On top of the purchase price, a secondary market buyer takes on every operational burden: ARIN transfer fees, ASN registration or procurement if they do not already have one, transit agreements for BGP announcement, rDNS delegation requests, RPKI ROA configuration, and the ongoing cost of monitoring and remediating any reputation damage that existed in the block before acquisition. There is no support relationship. If the block arrives with a Spamhaus listing that predates your ownership, the remediation process is entirely your problem.

Leasing from a compliant provider changes the cost structure fundamentally. You pay a monthly or annual fee — typically a fraction of the capital cost of outright purchase — and the provider handles ARIN registration, rDNS delegation, RPKI ROA maintenance, and BGP announcement. The block arrives operationally ready. For a hosting company deploying infrastructure for mail servers, multi-IP sending, or dedicated customer IP ranges, the operational overhead eliminated by leasing is often worth more than the difference in long-term cost.

The scenario where buying makes more sense is narrow: an organization with a long-term need (10+ years), existing BGP infrastructure, in-house network engineers who can manage RPKI and rDNS, and the capital to absorb a $20,000+ purchase without affecting operations. Most hosting companies and SaaS startups do not fit that profile. For them, leasing eliminates the upfront cost, the operational complexity, and the risk of acquiring a reputation-damaged block.

If you need a clean, BGP-ready /24 for your hosting or mail infrastructure, ServerSpan's IPv4 subnet leasing service provides ARIN-compliant /24 blocks with full rDNS delegation and RPKI ROA coverage. Allocation requests are reviewed and provisioned within 1–2 hours of approval.

ARIN Compliance and Documentation

ARIN's policies require that any organization using registered IPv4 space — whether through direct allocation, transfer, or sub-assignment from a registered holder — maintains accurate WHOIS data and uses the addresses for legitimate, documented network purposes. For a leasing arrangement, this means the provider collects documentation from the lessee: typically company registration documents, government-issued identification, and a network usage plan that describes how the /24 will be used and what infrastructure it will support.

This requirement is a trust signal, not a barrier. A provider who requests and verifies this documentation is maintaining ARIN-compliant WHOIS records, which directly protects the reputation of the block. Blocks allocated to verified, documented organizations have lower abuse rates and a cleaner baseline reputation than blocks sub-delegated without any vetting. If your use case is mail delivery — where WHOIS transparency is one of the soft signals that receiving MTAs and anti-abuse systems evaluate — documented compliance is not overhead, it is infrastructure.

By contrast, grey-market intermediaries who sub-lease blocks without collecting proper documentation create compliance risk for the lessee. If ARIN audits the block's usage or if an abuse complaint triggers a WHOIS investigation, a lessee whose use is undocumented has no standing in the record. For a hosting company whose deliverability and uptime depend on IP reputation, this is an unacceptable operational risk.

The Email Deliverability Case

The clearest operational justification for leasing a dedicated /24 is outbound email infrastructure. Shared IP addresses — whether from a hosting provider's general pool or from a low-cost VPS plan — carry the sending history of every other tenant on that range. One compromised account, one spam campaign, one misconfigured bulk sender is enough to trigger a /24-level Spamhaus listing that affects every IP in the block.

A dedicated /24 gives your organization full control over that sending history. Combined with correct SPF, DKIM, and DMARC configuration, a clean /24 with a verified PTR record for each sending IP is the baseline infrastructure for reliable inbox delivery at volume. The alternative — attempting to maintain deliverability on shared IP space — is an ongoing maintenance problem that becomes proportionally more difficult as sending volume increases.

For a detailed walkthrough of the email authentication layer that sits on top of IP reputation management, see email reputation management for VPS hosting and how to read DMARC reports and fix authentication failures. IP reputation and DMARC policy work together — one without the other leaves gaps that affect deliverability.

Diagnosing Whether You Actually Need a /24

Not every hosting operator needs a /24. The decision depends on what you are running and how many distinct sending identities or IP assignments your infrastructure requires.

You need a dedicated /24 if you are operating a mail server platform where you send on behalf of multiple customer domains and need separate IPs per domain or domain group. You need it if you are running a hosting platform and want to offer dedicated IP addresses to customers who require clean IP assignments for their own mail infrastructure. You need it if your SaaS product sends transactional email at volume and you have exhausted the deliverability headroom of shared IP pools.

You probably do not need a /24 if you are running a single-domain mail server with modest volume and a clean sending history. A single dedicated IP — or a small block — may be sufficient, and many VPS providers including ServerSpan can provision dedicated IPs for VPS plans without requiring a full subnet allocation. The /24 threshold becomes relevant when you need 50 or more distinct IPs with individual PTR records, or when you are building infrastructure you plan to expand over 12–24 months.

Request Your /24 Allocation

ServerSpan provides ARIN-compliant IPv4 /24 subnet leasing with full rDNS delegation, RPKI ROA coverage, and BGP-ready announcement. Allocation requires company registration documentation, government ID, and a network usage plan. After approval, setup completes within 1–2 hours.

Submit your allocation request on the IPv4 subnet leasing page — the form collects the required compliance documentation and initiates the review process.