Resolver
Name lookups checked against the graph before they are answered, and the account policy that decides the rest.
In this section
- How Resolution WorksWhat happens between a name lookup arriving and its answer, and what a refusal looks like on the wire.
- Encrypted DNSPoint a host's name lookups at your account over a private channel, then confirm the answers are coming from it.
- Resolver PolicyThe fields that decide which names your account answers, which it refuses, and who is allowed to ask.
Resolver Documentation
Every name an agent looks up through Whisper is checked against the Whisper graph before it is answered. Names the graph judges dangerous never resolve, names it has no opinion about are resolved normally, and your account decides what happens at the edges.
dig @<your resolver address> example.com AAAA +short
That address comes back as resolver_ip when you mint an identity, and it is one of the
two ways in. How Resolution Works is the page to
read first: it walks one lookup from arrival to answer, including what a block looks like
on the wire and what happens when the graph stays silent.
Encrypted DNS is the other way in, and the one to use where a host cannot send plain DNS to an address of its own. It covers the per-agent URL, the header forms, and pointing a machine at it with one command.
What you can change is on Resolver Policy: the default action, the lists of names you always block or always allow, the resolution mode, which sources may use your resolver address, and the separate argument that carries category and geography rules. Policy is set once for the account and applies to every agent and every device on it.
A phone or a laptop can use the same resolver without running an agent. That path has its own chapter at Devices.