IP Geolocation Is Evidence, Not Certainty, Experts Say

At APNIC 62, held in Mumbai, India, from 4 to 10 September 2026, network operators and internet infrastructure specialists discussed a topic that affects almost every online service: IP geolocation, the practice of estimating where an internet connection is physically located based on its IP address. The session, called "Behind the pin: The reality of IP geolocation," made clear that geolocation is not a simple lookup. It is an assessment built from many data sources, and the results are often treated with more confidence than they deserve. The speakers raised concerns about data quality, privacy, and the uneven adoption of geofeeds, which are files published by network operators that list where their IP address ranges are actually used.

Regional Internet Registries, or RIRs (the organizations that allocate IP addresses in different parts of the world), run Whois and the Registration Data Access Protocol, known as RDAP. These services record which organization holds an IP address block. But the panel emphasized a common misunderstanding: that data shows where an address is registered, not where it is used. Whois and RDAP have supported more specific registrations for years, allowing resource holders to attach different two-letter country codes (ISO 3166) to specific address ranges within their holdings. But true geographic location requires additional mechanisms, including RFC 8805, which defines a format for publishing geographic data, and RFC 9632, which provides a standard way to discover that information.

Anand Raje from the Advanced Internet Operations Research in India (AIORI) project described work on measuring, validating, and analysing IP geolocation. The project is building a platform that combines measurement data with published location information. Raje stressed that geolocation should be treated as evidence, not certainty. An IP address can often be linked to a country, region, or city, but it does not identify a specific person, device, or exact physical location. Accuracy depends on the source and the confidence behind it. Geolocation supports decisions ranging from content delivery and traffic engineering to fraud detection, compliance checks, sanctions screening, and public safety. As the impact of those decisions grows, the cost of an error grows too. No single technique can reliably determine location, Raje said. Effective systems combine registry and routing data, active measurements, machine learning, operator-published geofeeds, and information provided by the user's own device. To gather independent evidence, AIORI has deployed around 500 geolocated measurement anchors across India and an anycast testbed spanning more than 10 locations. Raje also pointed to low geofeed adoption in the APNIC region, noting that most published geofeed prefixes still come from outside the Asia Pacific. Analysis of geofeed data shows wide variation in precision: many records provide city-level information, while relatively few include street-level detail, partly to protect user privacy. He posed three questions: What is limiting geofeed adoption in the APNIC region? How should geolocation evidence be assessed when decisions carry different levels of risk? How can location claims be made verifiable, explainable, and contestable?

Dhruv Dhody presented findings from an Internet Architecture Board (IAB) workshop held in late 2025. He noted that IP addresses were not designed to carry geographic meaning, yet geolocating them has become ingrained in many functions of the web. An IP address is a geography-neutral identifier whose primary job is to provide unique addressing within an internet protocol network. It is carried in packets and routed using protocols such as Border Gateway Protocol (BGP), Open Shortest Path First (OSPF), and Intermediate System to Intermediate System (IS-IS). Over time, these addresses have become closely tied to real-world questions about where traffic originates and where it is headed. Governments, businesses, researchers, and users increasingly want that geographic information. But existing approaches are under strain as connectivity becomes more dynamic: low-Earth-orbit satellite networks, multinational mobile providers, and highly distributed service architectures all make location mapping more difficult. Users often move between networks while an application session remains active. At the same time, regulatory, commercial, and social demands for location information continue to rise. Future geolocation systems will need to improve accuracy while protecting user privacy.

Sid Mathur, who spoke on the Cooperation SIG panel and in a later session on AI, focused on self-published geofeeds and the role of RIRs. He described the publication and discovery mechanisms defined in RFC 8805 and RFC 9632, and showed how AI tools can spot inconsistencies and help proofread geofeed data. Mathur argued that RIRs are in a unique position because they already operate the authoritative registration systems used to identify resource holders. Instead of creating new processes, the existing registry framework could provide a trusted foundation for geolocation publication. Geofeed publication builds on workflows operators already understand and creates a verifiable chain of trust through RFC 9632. He presented data showing large regional differences: in a sample of geolocation records associated with Whois-discoverable networks, 75.5% of successful geofeed publishers were in the RIPE NCC region, 21.6% in the ARIN region, and only 3.0% in the APNIC region. To help close that gap, Mathur called for more consistent support from all RIRs. He pointed to RFC 9877, co-authored by APNIC and ARIN and published in October 2025, as an existing mechanism that could simplify deployment. His main recommendation was to make geofeed publication a one-click function inside member portals and registry dashboards. An informal APNIC community survey found that uncertainty about how registries could help was one of the main barriers to adoption.

Shailesh Gupta gave an internet service provider perspective. He highlighted that six major geolocation providers combine RIR data and geofeed information with their own datasets and methodologies. As a result, organizations that need to correct geolocation errors often face multiple reporting and remediation processes. Gupta stressed that geofeeds should be viewed as a best-effort mechanism. Their accuracy is influenced by data sources, update cycles, VPN usage, and changing network deployment practices. In many cases, location data is intentionally approximate for privacy reasons, identifying only a state or city rather than a precise location. In other cases, it becomes inaccurate because network assignments and usage patterns change over time. An ISO 3166 country code can often be considered reasonably reliable, but accuracy generally decreases at state and sub-regional levels, and falls further at city, suburb, and street levels. Gu