Glossary

What Is SPF?

SPF (Sender Policy Framework) is a DNS record listing the mail servers authorized to send email for a domain. Receiving servers check it to detect forged sender addresses, making SPF a first line of defense against domain spoofing and phishing.

How Whisper models it

HOSTNAME—SPF_INCLUDE / SPF_IP→authorized sender

Each SPF mechanism is its own edge type, so the full authorized-sender set is one traversal.

SPF reach of a domainOpen in Console →
MATCH (h:HOSTNAME {name:"paypal.com"})-[:SPF_INCLUDE|SPF_IP|SPF_A|SPF_MX]->(s) RETURN s.name LIMIT 10

Where this shows up

See it in a live investigation: Grade DNS & email posture.

Go hands-on with the DNS & email recipes.

Workflows that use this

Runnable workflows where this concept does the work.

Indicator Enrichment

Everything worth knowing about one indicator, on a single card. Give it a domain or an address and it fills in the picture: who registered it, where it's hosted and in which country, its mail and name servers, the network behind it, and a reputation read. The fast way to go from a bare indicator to real context before you decide what to do with it.

SharePostLinkedInEmail