Hacker News Reader

Comment by kyrra | Hacker News Reader

If you don't mind blocking everything hosted on GCP as well:

> dig TXT +short _netblocks{,2,3}.google.com | tr ' ' '\n' | egrep "(ip4:|ip6:)"

Gives you a full list of all of Google's IP blocks. You can just blackhole those.

This is far from a complete list - I got only 8 netblocks with that command. Try this one instead which queries Merit RADb:

    whois -h whois.radb.net '!gAS15169'

That's just their SPF record. It's only a list of IPs that google.com email might come from (or any domain that imports those records)

It's in SPF format, but it's also everything. See e.g. https://cloud.google.com/appengine/kb/

Another method is using GeoIP's ASN database, but they also run many ASNs so it would require a little effort to ensure you have them all

how come this seems to only work with ".google.com" tld?

I tried .apple.com, .yahoo.com, etc. and got nothing.

It's not a shortcut or anything, those are just Google's SPF records (which as noted above are drastically incomplete, they are only the IPs from which Google sends email).

Reply on news.ycombinator.com