Operational status for this node: ns1.
A registry should show how the service is actually running, not just how big it is. Below is a live dashboard of this nameserver's own counters - queries served, egress traffic, the graph-vs-upstream decision split, latency and the busiest names - read at the moment you load the page and refreshed in place. Each node keeps its own numbers and reports only those, so they are always true to the box that answered. This page is served identically from ns1 and ns2.
The charts read /stats/data.json from this same node and refresh every 30 seconds. With JavaScript off, the same counters are shown below as plain text. When a counter is briefly unavailable we leave its line blank rather than guess; none is typed by hand.
Traffic over the last 24 hours
combinedA time-series of DNS queries per second and egress bytes (sent and received) over the window. The same figures appear in the per-node cards below.
Where the answers come from.
Answered by the graph, or by DNS
When the Whisper graph has an opinion on a name we answer from it; otherwise we return real DNS. This is the share of each.
Queries by record type
Answers by response code
Queries by transport
Latency, and each node.
Resolver latency
Time to answer a resolver query, nothing else. The egress proxy also looks names up on its way to a destination; those lookups are a different job and are kept out of this figure.
ns1
ns2
For operators.
Fleet shape
Anycast sends a resolver to whichever node is
closest on the network, so an even split is not expected and an uneven one is not a
fault. Egress is a single anycast /32 anchored on whichever node holds the
AnyIP binding, so it is a fleet figure rather than a per-node one.
Answer discipline
Every answer is either the graph's opinion or a real DNS answer from upstream. A node that cannot reach the graph fails OPEN and keeps answering, so a graph outage costs opinions, never resolution.
What this page cannot tell you
Listed rather than defaulted to zero. A gauge that has not been read and a gauge that reads zero are the same number unless something says which, and on a status page that difference is the whole point.
Verify any of this yourself
| This payload | curl https://nic.whisper.online/stats/data.json |
|---|---|
| Both nameservers agree | dig +short SOA whisper.online @ns1.whisper.online |
| DNSSEC from the IANA root | delv @ns1.whisper.online whisper.online SOA |
| An agent's identity, keyless | dig -x <agent /128> @ns1.whisper.online |
| The registry record | curl https://nic.whisper.online/registry.md |
No account, no key. If a number here disagrees with what those commands return, the commands are right.
The busiest of everything.
Top query names
Top egress destinations
Busiest tenants (k‑anon)
Updated 2026-09-15 18:42 UTC. The top-name and tenant lists publish only masked, k-anonymised entries, never an individual client. The published figures are licensed for reuse; see the data licence.
How this nameserver is running.
| DNS resolutions answered | 23,396 |
|---|---|
| Resolutions by type | A 1,698, AAAA 1,410, SOA 16,308, NS 224, DS 45, DNSKEY 1,218 |
| WHOIS queries served (port 43) | 0 |
| RDAP queries served | 0 |
| Top resolvers (k-anonymised) | 2a00:1450:4001::/48 70, 172.217.33.0/24 41, 2a01:4f9::/48 37, 172.253.1.0/24 24, 172.217.34.0/24 19, 2a00:1450:4013::/48 11, 3.65.128.0/24 8, 187.40.244.0/24 6, 2620:171:f9::/48 6, 173.194.170.0/24 2, 74.125.114.0/24 2, 2400:cb00:521::/48 1, 2400:cb00:555::/48 1 |
| Zone serial | 1789493128 |
| Uptime | 1h 18m |
| Answer-cache hit rate | 57.9% |
Resolver figures count every answer this node has served. The top-resolver list publishes only masked, k-anonymised prefixes, never an individual client address. A blank line means that counter is not wired or is briefly unavailable on this node; the rest of the page stands.
What is registered right now.
Each agent identity is a single /128 with reverse DNS, an RDAP record, and a WHOIS entry. Look any of them up from the how-to on the overview.
The network and the address space.
The block sits within RIPE allocation 2a04:2a00::/31, and every agent record refers up to RIPE's own record for 2a04:2a01::/32. The chain from a single agent address to the regional registry is one anyone can walk.
The graph an agent gets to ask.
Before it connects, an agent can ask one keyless question from inside its own address: who really runs this host, and is it safe. The answer comes back from this map of the live internet, every identity answer DNSSEC-signed.
Updated 2026-09-15 18:42 UTC. Live figures carry a current timestamp; a last-known-good figure is labelled as of its snapshot, so a stale number is never paired with a minute-precise now. The published figures are licensed for reuse; see the data licence.
A record you can read, and check.
Read the rules that hold every identity, or see how names work.