Geofeed

A geofeed is a collection of IP networks accompanied by geolocation information, published as a CSV file over an https link. It lets a network operator state authoritatively where their own address space is actually used, instead of leaving geolocation databases to guess.

The format is standardised in RFC 8805 (the file format itself) and RFC 9092, which defines how to advertise a geofeed through a geofeed: attribute in RIR whois data so that consumers can discover it automatically rather than having the URL passed around informally.

What is the format of a Geofeed?

Geofeeds are published over https as a CSV file. Each line has five fields, of which only the first is mandatory:

• IP network in CIDR (Classless Inter-Domain Routing) format, e.g. 192.168.1.0/24.
• Country (optional): a 2-letter ISO 3166-1 alpha-2 country code, e.g. DE for Germany.
• Region (optional): an ISO 3166-2 region code, which includes the country prefix, e.g. DE-HE for Hessen in Germany.
• City (optional): UTF-8 encoded text. Using the English form is recommended, e.g. Munich rather than München.
• Postal code (optional): free-form text.

An optional field is left empty, but the commas separating it must still be present. Lines beginning with # are comments.

By example such a feed can look like:

# Published at https://mysite.public/geofeed.csv
# Updated at 2023-03-17
# ip_prefix,alpha2code,region,city,postal_code
123.124.0.0/16,DE,DE-BE,Berlin,12345
2001:df8::/32,DE,DE-BE,Berlin,12345
34.30.128.0/17,NL,NL-GR,Groningen,
34.31.0.0/16,US,US-IA,Council Bluffs,
34.32.0.0/16,NL,NL-GR,Groningen,
34.64.32.0/19,KR,KR-11,Seoul,

What are real world examples of a Geofeed?

You can have a look at some Geofeeds from:

• Google: https://www.gstatic.com/ipranges/cloud_geofeed
• Starlink: https://geoip.starlinkisp.net/feed.csv

These Geofeeds were selected, because they are bigger and can be viewed in a browser.

Why do Geofeeds matter for email?

Receiving mail systems and spam filters routinely use the geographic origin of a connecting IP address as one input among many. A connection whose apparent country does not match the sender’s stated location, or which resolves to a region associated with high abuse rates, can attract additional scrutiny.

The problem is that commercial geolocation databases are frequently wrong, especially after address space is transferred or re-deployed to another country. Stale data can leave a mail server that is physically in Frankfurt being treated as if it were somewhere else entirely, with the filtering consequences that follow.

If you operate your own address space, publishing a geofeed — and referencing it from your RIR whois record as described in RFC 9092 — is the mechanism for correcting that at the source, rather than filing correction requests with each database individually. It sits alongside correct reverse DNS as part of describing your infrastructure accurately to the systems that judge it.