DNS & Email Security

SPF, DMARC, DNSSEC, and mail routing each live in a different checker, and none of them is crossed with the live infrastructure behind the records. WhisperGraph holds both layers in one graph: the six SPF mechanism types as typed edges, DMARC reporting recipients, DKIM signing vendors, MX and nameserver delegation, and, next to them, the resolution, routing, WHOIS, and threat-verdict data for every host those records point at.

That join changes what an audit can see. A syntactically valid SPF include is still a risk if it authorizes infrastructure you would not trust, and a checker that stops at the record cannot tell. One traversal grades the published posture and follows every reference into the hosts it actually reaches. And because the DNS layer is part of the same graph, nameserver drift and lame delegation show up as query results before they become a hijack.

Run it

Five guided workflows run these audits in the browser on any domain you paste in, with the Cypher behind every step visible and editable.

Workflow	What it does
Grade DNS & email posture	Grades a domain's email-auth posture in one pass: SPF reach, DMARC reporting, DKIM vendors, mail servers, and the reputation of the infrastructure behind them.
Audit mail-server & MX hygiene	Enumerates mail servers, flags lame delegation and the MX-less gap that makes a domain trivially spoofable, and sizes SPF reach.
Check nameserver-hijack / DNS-delegation consistency	Lists a domain's nameservers and flags lame or inconsistent delegation, a DNS-hijack exposure signal.
Iris-style full record card	One domain in, a flat record card out: registrar, registrant, nameservers, mail servers, resolved IPs and ASN, threat verdict, SPF includes, CT observations.
Shared email-auth sender cluster	Pivots a domain through its SPF include hosts and DKIM vendors to the cluster of other domains sharing the same senders, each enriched with registrant and verdict.

Anonymous runs are capped at 2 traversal hops; a free API key raises the depth cap to 3. See Getting Started for how to get a key.

Recipes

Posture Audits is the copy-paste companion: validated Cypher for nameserver and MX inventories, the full SPF authorization tree, DMARC, DKIM and DNSSEC checks, portfolio-wide scorecards, and lookalike mail checks.

The pivots these audits are built from repeat across domains; Cross-Layer Patterns collects them. Subdomain discovery and full footprint mapping live under Attack Surface & Recon.