# Resolver

> Whisper's policy resolver asks the graph for a verdict on every name before answering, over encrypted DNS or your account's own resolver address.

*Source: https://www.whisper.security/docs/network/resolver*

---
Every name an agent looks up through Whisper is checked against the Whisper graph before
it is answered. Names the graph judges dangerous never resolve, names it has no opinion
about are resolved normally, and your account decides what happens at the edges.

```bash
dig @<your resolver address> example.com AAAA +short
```

That address comes back as `resolver_ip` when you mint an identity, and it is one of the
two ways in. [How Resolution Works](/docs/network/resolver/how-it-works) is the page to
read first: it walks one lookup from arrival to answer, including what a block looks like
on the wire and what happens when the graph stays silent.

[Encrypted DNS](/docs/network/resolver/encrypted-dns) is the other way in, and the one to
use where a host cannot send plain DNS to an address of its own. It covers the per-agent
URL, the header forms, and pointing a machine at it with one command.

What you can change is on [Resolver Policy](/docs/network/resolver/policy): the default
action, the lists of names you always block or always allow, the resolution mode, which
sources may use your resolver address, and the separate argument that carries category and
geography rules. Policy is set once for the account and applies to every agent and every
device on it.

A phone or a laptop can use the same resolver without running an agent. That path has its
own chapter at [Devices](/docs/network/devices).