A new home, already real. Come meet the first resident.

Its address is its identity:

2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478

The address names itself. Ask reverse DNS who lives there:

$ dig -x 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 +short
ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online

Reverse DNS spells the address back as a name: deterministic, signed, and ours. check it on a resolver you already trust.

The forward name points back to the same address. The loop closes:

$ dig +short AAAA ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online
2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478

check it on a resolver you already trust.

The registry knows it by name. Read-only, runs nothing:

$ curl -s https://rdap.whisper.online/ip/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 | jq -r .name
scout

run it in your browser for the whole record, as JSON.

WHOIS knows it too, on our own land (verbatim from the port-43 response, re-captured by the implementer on build day):

$ whois -h whois.whisper.online 2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478
inet6num    2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478
netname     scout
descr       Whisper agent identity
agent       aa98d5d20fd7731de
tenant      ta8e69486f260c280b1134c868cc42fef
fqdn        ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online
reverse     e.d.1.3.7.7.d.f.0.2.d.5.d.8.9.a.5.c.6.f.c.9.2.f.1.0.a.2.4.0.a.2.ip6.arpa
status      active
allocated   2026-06-24T07:21:24.643Z
country     NL
origin      AS219419
org         viaGraph B.V.
aggregate   2a04:2a01::/32
posture     tier1.5
rdap-uri    https://rdap.whisper.online/ip/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478
source      WHISPER
% see RDAP: https://rdap.whisper.online/ip/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478
% RDAP is the canonical, machine-readable source of truth for Whisper agent identities.

Its key is pinned in DNS itself. This is the agent's key, written into signed DNS itself, so no certificate authority sits between you and the proof:

$ dig +short TLSA _443._tcp.ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online
3 1 1 9EC1EF18A1F15E5480A0FC3C8D6E9690B2CCF1A7FA7146201940F28C 422BB47D

check it on a resolver you already trust.

And the whole chain, in one keyless call:

$ curl -s https://rdap.whisper.online/verify-identity/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478 | jq '{is_whisper_agent,dane_ok,jws_ok}'
{
  "is_whisper_agent": true,
  "dane_ok": true,
  "jws_ok": true
}

run it in your browser for the same keyless verdict, as JSON.

And the friendly name you call it by resolves to the very same agent. Even the name on the door checks out, in signed DNS:

$ dig +short CNAME scout.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online
ae3b051ff3bf7f478.tdc38e7c55bad3306a92b830f9bb1e4f9.agents.whisper.online

Bring your own domain and that name can live under it, like scout.acme.com. check it on a resolver you already trust.

That is seven independent proofs, every one run and pasted verbatim. The registry record links straight up to RIPE's own record for 2a04:2a01::/32, so the ground under this home is theirs to confirm too.

Once it's home, an agent can ask one keyless question before it connects, who really runs this host and is it safe, and get a real answer from the live graph. The address is the auth, so the answer comes back with no key to hand around.

That graph is a map of the live internet your agent gets to ask: 7.43B nodes and 39.8B relationships, and growing, every identity answer DNSSEC-signed. It is here so your agent never walks somewhere blind.

The graph runs on our own ground: AS219419, IPv6-only, RPKI-signed, MANRS, on 2a04:2a01::/32. Updated 2026-07-06 13:44 UTC.

And every step is written down. Each identity keeps an append-only, signed transparency feed of its own events at rdap.whisper.online/ip/2a04:2a01:b69a:6717:e3b0:51ff:3bf7:f478/transparency — a tamper-evident, signed log, so a revocation can never be quietly erased. The whole registry record, with every verification recipe and the bring-your-own-domain path, is published at nic.whisper.online/registry.

The lock that feeds your agent is the same lock that keeps a stranger from answering to your agent's name.

Try the same checks elsewhere. This is the only home where every door answers back.