---
title: "Geofeed"
description: "Format for Self-Published IP Geolocation information"
url: "https://mailmum.io/glossary/geofeed/"
---

# Geofeed

A geofeed is a collection of IP networks accompanied by geolocation information,
published as a CSV file over an https link. It lets a network operator state
authoritatively where their own address space is actually used, instead of
leaving geolocation databases to guess.

The format is standardised in [RFC 8805](https://www.rfc-editor.org/rfc/rfc8805)
(the file format itself) and [RFC
9092](https://www.rfc-editor.org/rfc/rfc9092), which defines how to advertise a
geofeed through a `geofeed:` attribute in RIR whois data so that consumers can
discover it automatically rather than having the URL passed around informally.

## What is the format of a Geofeed?

Geofeeds are published over https as a CSV file. Each line has five fields, of
which only the first is mandatory:

* **IP network** in CIDR (Classless Inter-Domain Routing) format, e.g.
  `192.168.1.0/24`.
* **Country** (optional): a 2-letter ISO 3166-1 alpha-2 country code, e.g. `DE`
  for Germany.
* **Region** (optional): an ISO 3166-2 region code, which includes the country
  prefix, e.g. `DE-HE` for Hessen in Germany.
* **City** (optional): UTF-8 encoded text. Using the English form is
  recommended, e.g. Munich rather than München.
* **Postal code** (optional): free-form text.

An optional field is left empty, but the commas separating it must still be
present. Lines beginning with `#` are comments.

By example such a feed can look like:

```csv
# Published at https://mysite.public/geofeed.csv
# Updated at 2023-03-17
# ip_prefix,alpha2code,region,city,postal_code
123.124.0.0/16,DE,DE-BE,Berlin,12345
2001:df8::/32,DE,DE-BE,Berlin,12345
34.30.128.0/17,NL,NL-GR,Groningen,
34.31.0.0/16,US,US-IA,Council Bluffs,
34.32.0.0/16,NL,NL-GR,Groningen,
34.64.32.0/19,KR,KR-11,Seoul,
```

## What are real world examples of a Geofeed?

You can have a look at some Geofeeds from:

* Google: [https://www.gstatic.com/ipranges/cloud_geofeed](https://www.gstatic.com/ipranges/cloud_geofeed)
* Starlink: [https://geoip.starlinkisp.net/feed.csv](https://geoip.starlinkisp.net/feed.csv)

These Geofeeds were selected, because they are bigger and can be viewed in a
browser.

## Why do Geofeeds matter for email?

Receiving mail systems and spam filters routinely use the geographic origin of
a connecting IP address as one input among many. A connection whose apparent
country does not match the sender's stated location, or which resolves to a
region associated with high abuse rates, can attract additional scrutiny.

The problem is that commercial geolocation databases are frequently wrong,
especially after address space is transferred or re-deployed to another
country. Stale data can leave a mail server that is physically in Frankfurt
being treated as if it were somewhere else entirely, with the filtering
consequences that follow.

If you operate your own address space, publishing a geofeed — and
referencing it from your RIR whois record as described in RFC 9092 — is
the mechanism for correcting that at the source, rather than filing correction
requests with each database individually. It sits alongside correct [reverse
DNS](https://mailmum.io/glossary/reverse-dns-rdns/) as part of describing your infrastructure
accurately to the systems that judge it.