# Whisper NIC naming policy: how friendly names work. > Every name resolves, in signed DNS, back to the agent's canonical address. Every agent already has a canonical name: its address, spelled back by reverse DNS. On top of that you can give it a friendly name of your own. The rules here keep friendly names honest, so a name always resolves, in signed DNS, to exactly the agent it claims. ## How friendly names work Each agent has one canonical FQDN of the form `..agents.whisper.online`, and that name resolves to the agent's `/128`. A friendly name is a CNAME that points at the canonical name, published in DNSSEC-signed DNS. Following it lands you on the same address: ```sh $ dig +short CNAME scout.t.agents.whisper.online .t.agents.whisper.online. ``` The friendly name is convenience, not authority. The address and the canonical name are the identity; a friendly name only ever points at them. Because the chain is signed, a friendly name cannot be made to lie about which agent it reaches. ## Allowed forms A friendly label follows the ordinary DNS label rules, so any resolver and any tool handles it without surprise: - Letters `a` to `z`, digits `0` to `9`, and the hyphen. - It does not start or end with a hyphen, and it is one to 63 characters. - It is case-insensitive and stored lower-case (we are conservative in what we emit). - Internationalized names are accepted in their `xn--` A-label form. - One friendly label maps to exactly one agent. A label is not shared between agents. Be liberal in what you submit: a trailing dot, mixed case, or surrounding whitespace is accepted and normalized. We reject only what would be ambiguous or unsafe, and we reject it with a clear message, never silently. ## Names we hold back Three classes of label are not available as friendly names, each refused at registration with its own clear, distinct reason. We publish every list in full, served straight from the file the registration path enforces, on the reserved and premium names page: . - **Reserved infrastructure names** so a friendly name cannot impersonate the infrastructure: the RFC 2142 role names (`hostmaster`, `abuse`, `security`, and the rest) and our own service names (`www`, `ns1`, `doh`, `rdap`, `whois`, `nic`, `connect`, and so on). - **Premium names**, a curated set of high-value generic terms and well-known brands, held for a stated use. Ordinary common words stay freely registrable. - **Offensive names**, matched against a permissively-licensed blocklist and rejected. Protocol and well-known prefixes are also held: anything beginning with an underscore (such as `_acme-challenge` or `_443._tcp`), and the `.well-known` space. Names that misrepresent operatorship or imitate another organization in bad faith are refused on review. If a reserved, premium, offensive, or otherwise unavailable label is requested, the request is refused with a clear, specific reason, and a suitable alternative is suggested where one exists. See the full lists at . ## Bring your own domain You can host a friendly name under a domain you control, so a name like `scout.acme.com` reaches the agent while the network and registry that vouch for it stay ours. You publish the CNAME in your own zone: ``` scout.acme.com. CNAME .t.agents.whisper.online. ``` The rules for a bring-your-own-domain name: - You must control the domain. We do not point a Whisper agent at a name you cannot prove is yours, and we do not let you point a name you control at someone else's agent. - Sign your own zone with DNSSEC to keep the chain intact end to end. An unsigned parent breaks the guarantee at your boundary, not ours. - The agent's canonical name and address remain the source of truth. Your name is an alias to them; the registry record still reads against the `/128`. - You are responsible for the contents and conduct of names in your own domain, as the holder. **Going further (rolling out).** A CNAME aliases one name. You can instead delegate a whole domain to us — point its `NS` at `ns1.whisper.online` / `ns2.whisper.online` and publish the `DS` we hand you — and have new agents minted *natively* under it, as `a.`, with DANE-EE trust anchored by your own `DS`. The proof is the delegation plus `DS` observed live in the wild, fail-closed, no token to copy. See the complete record for how onboarding, proof, and issuance work: . ## Choosing a good name A name is read by people and by machines. A good one is plain and lasting: - Describe the role, not the run: `billing-reconciler` ages better than `agent-final-v3`. - Keep it short and lower-case. It will be typed, logged, and read aloud. - Avoid dates, ticket numbers, and secrets. A name is public the moment it resolves. - Do not imitate another party. A name that pretends to be someone else is both bad form and a policy breach. - Prefer a name you will keep. Renaming is allowed, but the canonical address is the stable anchor; lean on it for anything that must not move. A friendly name should make an agent easier to talk about while changing nothing about who it is. The address stays the truth; the name just makes it kind to read. --- - **The complete record:** - **Policy:** - **Reserved and premium names:** - **Live statistics:** - **Data licence:** - **The home for your agents:** - **AS219419:** - **Whisper Security:** © viaGraph B.V. (dba Whisper Security)