A name you can call it by, that checks out.

Each agent has one canonical FQDN of the form <agent>.<tenant>.agents.whisper.online, and that name resolves to the agent's /128. A friendly name is a CNAME that points at the canonical name, published in DNSSEC-signed DNS. Following it lands you on the same address:

$ dig +short CNAME scout.t<tenant>.agents.whisper.online
<agent>.t<tenant>.agents.whisper.online.

The friendly name is convenience, not authority. The address and the canonical name are the identity; a friendly name only ever points at them. Because the chain is signed, a friendly name cannot be made to lie about which agent it reaches.

A friendly label follows the ordinary DNS label rules, so any resolver and any tool handles it without surprise:

• Letters a to z, digits 0 to 9, and the hyphen.
• It does not start or end with a hyphen, and it is one to 63 characters.
• It is case-insensitive and stored lower-case (we are conservative in what we emit).
• Internationalized names are accepted in their xn-- A-label form.
• One friendly label maps to exactly one agent. A label is not shared between agents.

Be liberal in what you submit: a trailing dot, mixed case, or surrounding whitespace is accepted and normalized. We reject only what would be ambiguous or unsafe, and we reject it with a clear message, never silently.

Three classes of label are not available as friendly names, each refused at registration with its own clear, distinct reason. We publish every list in full, served straight from the file the registration path enforces, on the reserved and premium names page:

• Reserved infrastructure names so a friendly name cannot impersonate the infrastructure: the RFC 2142 role names (hostmaster, abuse, security, and the rest) and our own service names (www, ns1, doh, rdap, whois, nic, connect, and so on).
• Premium names, a curated set of high-value generic terms and well-known brands, held for a stated use. Ordinary common words stay freely registrable.
• Offensive names, matched against a permissively-licensed blocklist and rejected.

Protocol and well-known prefixes are also held: anything beginning with an underscore (such as _acme-challenge or _443._tcp), and the .well-known space. Names that misrepresent operatorship or imitate another organization in bad faith are refused on review.

If a reserved, premium, offensive, or otherwise unavailable label is requested, the request is refused with a clear, specific reason, and a suitable alternative is suggested where one exists. See the full lists on the reserved and premium names page.

You can host a friendly name under a domain you control, so a name like scout.acme.com reaches the agent while the network and registry that vouch for it stay ours. You publish the CNAME in your own zone:

scout.acme.com.   CNAME   <agent>.t<tenant>.agents.whisper.online.

The rules for a bring-your-own-domain name:

• You must control the domain. We do not point a Whisper agent at a name you cannot prove is yours, and we do not let you point a name you control at someone else's agent.
• Sign your own zone with DNSSEC to keep the chain intact end to end. An unsigned parent breaks the guarantee at your boundary, not ours.
• The agent's canonical name and address remain the source of truth. Your name is an alias to them; the registry record still reads against the /128.
• You are responsible for the contents and conduct of names in your own domain, as the holder.

Going further rolling out A CNAME aliases one name. You can instead delegate a whole domain to us — point its NS at ns1.whisper.online / ns2.whisper.online and publish the DS we hand you — and have new agents minted natively under it, as a<hex>.<yourdomain>, with DANE-EE trust anchored by your own DS. The proof is the delegation plus DS seen live in the wild, fail-closed, no token to copy. See the full record for how onboarding, proof, and issuance work: the complete record.

A name is read by people and by machines. A good one is plain and lasting:

• Describe the role, not the run: billing-reconciler ages better than agent-final-v3.
• Keep it short and lower-case. It will be typed, logged, and read aloud.
• Avoid dates, ticket numbers, and secrets. A name is public the moment it resolves.
• Do not imitate another party. A name that pretends to be someone else is both bad form and a policy breach.
• Prefer a name you will keep. Renaming is allowed, but the canonical address is the stable anchor; lean on it for anything that must not move.

A friendly name should make an agent easier to talk about while changing nothing about who it is. The address stays the truth; the name just makes it kind to read.