The ".top" TLD is popular among Russian spammers, ".ru" is a little too obvious and honest for what it is, unless that's part of Biden's sanctions, the others you mention look like vice domains, but looking at GitHub:

* https://github.com/dovecot

There's an "Oy" which is a Finnish "osalliyhdistys" and a ".fi" -- I have not heard of recent hostility between Finland and Russia, notwithstanding the Ukraine situation. Your mail client is all configured in Swedish, but Sweden & Finland are not officially part of NATO, AFAIK, and Sweden has its own currency whereas Finland did give up the markka in exchange for the Euro some 20-odd years ago I don't recall.


On February 12, 2022 2:58:03 AM AKST, Sebastian Nielsen <sebastian@sebbe.eu> wrote:
Thats a TLD ban. Meaning *.ru is banned.

same applies for my domain for example, I ban *.xyz, *.date and a few others.

-----Ursprungligt meddelande-----
Från: dovecot-bounces@dovecot.org <dovecot-bounces@dovecot.org> För Lev Serebryakov
Skickat: den 12 februari 2022 12:08
Till: dovecot@dovecot.org
Ämne: Re: Sv: dovecot mailing list (this mailing list), DKIM, SPF and DMARC

On 11.02.2022 16:31, Marc wrote:

  (sorry for posting to list this, but I don't have any ways to contact Marc off-list now)


    Problem is, I need to unpack each of them to be sure, that these 
 are false positives and I'm afraid, that it could lower reputation of 
 my mail server IP address with major providers (like Google Mail).


How can you get a lower reputation? Afaik dmarc is just signing your outgoing messages.
  Marc, my domain already has problems sending mail to you, for example:

<Marc@f1-outsourcing.eu>: host spam1.roosit.eu[212.26.193.45] said: 553 5.3.0
     550We have blocked this toplevel because of spam. Use another toplevel
     until the maintainer has resolved these issues (in reply to MAIL FROM
     command)

--
// Black Lion AKA Lev Serebryakov

--
Sent from my Android device with K-9 Mail. Please excuse my brevity.