Whalenet DNS Records
What a fleet publishes in its own subtree, how to read a name through the resolver in effect, the verbs that write.
On this page (6)
Whalenet DNS Records Documentation
whisper whale dns covers three things: which resolver this host is pointed at, what a name resolves to through it, and the records your fleet publishes in its own namespace.
Two things deliberately live elsewhere. The reverse name for an address is whisper whale whois, which validates it from the IANA root and needs no key: see inspect your fleet. Your resolution policy is whisper policy, documented in resolver policy.
dns status
whisper whale dns status
Shows the resolver profile whisper resolver applied on this host, and probes it with a real query so you see the round trip it took. The DoH URL carries a device credential in its path, so it is printed with that part masked; whisper resolver --print shows the profile in full when you need to paste it somewhere. Treat that URL as a password.
dns query
whisper whale dns query whisper.online AAAA
Resolves one name and prints two things beside the answer. The first is the resolver's own signal read off the wire: the RCODE and any RFC 8914 Extended DNS Error attached to it. A name declined by policy comes back REFUSED with EDE 17, Filtered, and that is the verdict itself rather than a guess about one. The second is the Whisper graph's assessment of the name, which is the input the resolver consulted, not a second opinion computed on this host.
The type defaults to A, and any RR type name works.
| Flag | Does |
|---|---|
--server | Ask a specific resolver instead of the one this host applied. |
dns record list
whisper whale dns record list
The records you publish today.
dns record set
whisper whale dns record set api CNAME db-01.t<tenant>.agents.whisper.online.
whisper whale dns record set _proof TXT 'whisper-site-verification=...'
whisper whale dns record set gateway AAAA 2a04:2a01:9::5
Publishes a record, replacing any record of the same name and type. The type is accepted in any case.
Where the name lands. A name with no trailing dot is placed inside your own subtree, which is always yours to write. A name with a trailing dot is taken exactly as written, which only works inside a domain you have proven: see bring your own domain.
| Flag | Does |
|---|---|
--ttl | Seconds to cache this record. The zone default when you do not pass it. |
Which types are allowed, and which names are reserved, are the control plane's rules, and it states them in the reply. This verb keeps no second copy that could disagree.
dns record delete
whisper whale dns record delete api CNAME
Removes one record you publish. rm is an accepted spelling. Removing something that is not there comes back as NOT_FOUND and is not an error, so this is safe to run twice and safe to put in a teardown script.
Node names are not editable here
A node's canonical name, and the member name beside it, are published and withdrawn by the identity plane with the agent they name, so the alias and the identity can never disagree. Rename or release the agent, and its name goes with it. The derivation is covered in nodes, names and tags.
Everything under your fleet's subtree is served from DNSSEC-signed authoritative zones, with a confirming forward record for every reverse one. Authoritative DNS covers the zone side.