Glossary
What Is SPF?
Published Last updated
SPF (Sender Policy Framework) is a DNS record listing the mail servers authorized to send email for a domain. Receiving servers check it to detect forged sender addresses, making SPF a first line of defense against domain spoofing and phishing.
How Whisper models it
Each SPF mechanism is its own edge type, so the full authorized-sender set is one traversal.
MATCH (h:HOSTNAME {name:"paypal.com"})-[:SPF_INCLUDE|SPF_IP|SPF_A|SPF_MX]->(s) RETURN s.name LIMIT 10Where this shows up
See it in a live investigation: Grade DNS & email posture.
Go hands-on with the DNS & email recipes.
Workflows that use this
Runnable workflows where this concept does the work.
Indicator Enrichment
Everything worth knowing about one indicator, on a single card. Give it a domain or an address and it fills in the picture: who registered it, where it's hosted and in which country, its mail and name servers, the network behind it, and a reputation read. The fast way to go from a bare indicator to real context before you decide what to do with it.
