DNS & email security
SPF, DMARC, DNSSEC, and mail routing each live in a different checker, and none of them is crossed with the live infrastructure behind the records. WhisperGraph grades the whole posture in one pass — the includes and where they reach, the mail servers a domain trusts, DNSSEC, DMARC policy — against the reputation of the hosts involved.
And because it watches the DNS layer as a graph, it catches nameserver drift before it becomes a hijack.
Why this is hard without a graph
An email-auth audit that stops at the record misses the point: a perfectly valid SPF include is still a risk if it points at infrastructure you wouldn't trust. Config checkers don't cross into the live graph, so posture and reality drift apart.
What changes with WhisperGraph
The config layer and the infrastructure layer are the same graph. One traversal grades the posture and follows every reference into the hosts it actually trusts, so the audit reflects what's live — not just what's published. The workflows below run it on any domain.
5 workflows in DNS & email security
Sign in with a Whisper account and each page runs its flow live, on the example input first and then on your own.
Attack-Surface Mapper
See your organisation the way an attacker does. Give it a domain and it maps the full external footprint — every subdomain, the name and mail servers, who registered it, the third-party services it leans on, and the wider web of sites it connects to — and scores the exposure. The starting point for shrinking what's reachable from the outside.
Indicator Enrichment
Everything worth knowing about one indicator, on a single card. Give it a domain or an address and it fills in the picture: who registered it, where it's hosted and in which country, its mail and name servers, the network behind it, and a reputation read. The fast way to go from a bare indicator to real context before you decide what to do with it.
Anycast DNS-Root Sovereignty
Could a country still resolve names if it were isolated? This assesses a nation's DNS-root resilience — how many of the core root servers have a copy inside its borders, and who operates them — the sovereignty read for national-resilience and policy analysis.
Nameserver & DNS Delegation Audit
Your name servers decide where your domain points — and a broken or inconsistent setup is a hijacking opportunity. This audits a domain's delegation, flags stale or mismatched name servers, sizes how much each provider actually handles, and surfaces registry facts — so you can catch delegation weakness before it's exploited.
Email Security Posture
Reads a domain’s SPF, DKIM, DMARC, MX and DNSSEC records straight off the graph and grades each on presence and hygiene: whether the control is configured, whether the SPF chain stays inside the ten-lookup limit, whether an SPF_IP authorization is unusually wide, whether a DKIM signer has no matching SPF authorization, and whether a mail-exchange address carries a threat verdict. Never grades enforcement strength — SPF’s -all qualifier and DMARC’s p= policy tag are not yet imported into the graph (whisper-dbj-ng#1865).
Run one of these
Sign in with a Whisper account and every flow above runs live on the graph, keeping your history with it.