RFC 8805 – Self-Published Geo Location Feeds

By Manny Fernandez

March 31, 2026

RFC 8805 – Self-Published Geo Location Feeds

RFC 8805, used to be known as Self-Correcting IP Geolocation Feeds, is a standard designed to improve the accuracy of how IP addresses are mapped to physical locations. For anyone running a network, especially in a world of remote work and dynamic cloud environments, it is a game-changer for reducing “latency” in geolocation database updates. This can be used to bypass geo-fencing scenarios as well.

The Problem: Stale Geolocation Data

Traditionally, IP geolocation depends on third-party providers to “guess” where an IP is located based on WHOIS data or network latency measurements. This process is often slow, leading to:

Users being served content in the wrong language.
Security tools flagging legitimate logins as “impossible travel.”
Inaccurate local weather or news feeds.

Third Party IP geolocation feed providers

MaxMind – A prominent, long-standing provider (est. 2002) known for its GeoIP databases, offering high-accuracy data for fraud detection, digital rights management, and content personalization.

IPinfo.io – Offers comprehensive IP geolocation, including ASN, ISP, and company data, recognized for accurate, fast API responses.

IP2Location – Provides databases and REST APIs focusing on accurate geolocation, including proxy and VPN detection, often used for content localization.

IPgeolocation.io – Trusted for reliable geolocation services for websites and applications to identify visitors.

DB-IP – Offers updated geolocation databases including country, region, city, and latitude/longitude.

IPData.co
ipstack
IP-API.com
Ipligence
Neustar (Localeze)
EurekAP

How we address with RFC 8805

RFC 8805 allows network operators to publish their own geolocation data in a simple, machine-readable format. Instead of waiting for a provider to crawl your network, you push the truth.

How it Works

The Feed – You host a simple CSV file on an HTTPS server.
The Content – Each line maps an IP prefix to a country, region, city, and postal code.
The Discovery – You add a link to this feed in your WHOIS/RDAP records using the remarks field.

Format Example

The CSV format is strictly defined to ensure compatibility: # IP_prefix, country, region, city, postal_code 192.0.2.0/24, US, NY, New York, 10001 203.0.113.0/24, CA, ON, Toronto,

What is WHOIS

* WHOIS is an older text‑based query/response protocol (defined in RFC 3912) that lets you look up registration data for Internet resources such as domain names, IP address blocks, and Autonomous System Numbers.
* It runs on its own TCP port (traditionally 43) and returns unstructured free‑text, which humans can read but is harder for software to parse reliably.
* Historically, RIRs (ARIN, RIPE, etc.) and many domain registries published IP and domain registration data via WHOIS, and tools like whois 203.0.113.0 are still common.

What is RDAP

* RDAP (Registration Data Access Protocol) is the modern, HTTP/HTTPS‑based replacement for WHOIS for accessing registration data for domain names, IP addresses, and ASNs.
* It returns structured JSON responses, with standardized fields, internationalization support, redirects, and extensibility, making it easier for automated tools to consume.
* ICANN and RIRs have moved to RDAP as the primary protocol, and ICANN has formally sunsetted WHOIS for gTLD domain registration data in favor of RDAP.

Why It Matters for InfoSec & Ops

Precision – You define the location down to the city level for your VPN pools or branch offices.
Privacy – The RFC specifically allows for “omitting” specific details (like postal codes) to protect user privacy while still providing regional accuracy.
Automation – Geolocation providers automatically scrape these feeds, meaning your changes propagate across the internet in days rather than weeks.

To run whois search on macOS , run the following command

whois infosecmonkey.com

To run rdap queries on macOS, you will need to install it (using homebrew)

brew install rdap

Once you install it, you can now run it….

rdap infosecmonkey.com

RFC 8805 – Self-Published Geo Location Feeds

The Problem: Stale Geolocation Data

Third Party IP geolocation feed providers

How we address with RFC 8805

How it Works

Format Example

What is WHOIS

What is RDAP

Why It Matters for InfoSec & Ops

Recent posts