← New trace

Tracing @bsky.app

6 hops · 384ms total

1

Handle Resolution

✓ success
153ms

Resolve the handle "bsky.app" to a DID. First tries HTTPS well-known, then falls back to DNS TXT record. Method used: DNS TXT _atproto.

GET DNS TXT _atproto.bsky.app

Key Data

did
did:plc:z72i7hdynmk6r22z27h6tvur
method
DNS TXT _atproto
Raw Response 
{
  "Status": 0,
  "TC": false,
  "RD": true,
  "RA": true,
  "AD": false,
  "CD": false,
  "Question": [
    {
      "name": "_atproto.bsky.app",
      "type": 16
    }
  ],
  "Answer": [
    {
      "name": "_atproto.bsky.app",
      "type": 16,
      "TTL": 300,
      "data": "\"did=did:plc:z72i7hdynmk6r22z27h6tvur\""
    }
  ]
}
🔒 You're trusting DNS and the domain operator to return the correct DID.
▼
2

DID Document Fetch

✓ success
44ms

Fetch the DID document for did:plc:z72i7hdynmk6r22z27h6tvur. Using plc.directory (centralized DID registry).

GET https://plc.directory/did:plc:z72i7hdynmk6r22z27h6tvur

Key Data

id
did:plc:z72i7hdynmk6r22z27h6tvur
alsoKnownAs
at://bsky.app
verification_methods_count
1
services_count
1
Raw Response 
{
  "@context": [
    "https://www.w3.org/ns/did/v1",
    "https://w3id.org/security/multikey/v1",
    "https://w3id.org/security/suites/secp256k1-2019/v1"
  ],
  "id": "did:plc:z72i7hdynmk6r22z27h6tvur",
  "alsoKnownAs": [
    "at://bsky.app"
  ],
  "verificationMethod": [
    {
      "id": "did:plc:z72i7hdynmk6r22z27h6tvur#atproto",
      "type": "Multikey",
      "controller": "did:plc:z72i7hdynmk6r22z27h6tvur",
      "publicKeyMultibase": "zQ3shQo6TF2moaqMTrUZEM1jeuYRQXeHEx4evX9751y2qPqRA"
 
...
🔒 For did:plc, you're trusting plc.directory. The DID document is signed but the directory is centralized.
▼
3

Handle Verification (Bidirectional)

✓ success
0ms

Check that the DID document's alsoKnownAs field contains "at://bsky.app". Handle resolved to DID (hop 1) and DID document lists handle (hop 2) must agree.

VERIFY DID document alsoKnownAs field

Key Data

expected_handle
bsky.app
did_document_handles
bsky.app
bidirectional_match
true
🔒 Bidirectional verification prevents handle hijacking — both sides must agree.
▼
4

PDS Discovery

✓ success
66ms

Found PDS at https://puffball.us-east.host.bsky.network. Verified it's reachable by calling describeServer.

GET https://puffball.us-east.host.bsky.network/xrpc/com.atproto.server.describeServer

Key Data

pds_endpoint
https://puffball.us-east.host.bsky.network
available_user_domains
.puffball.us-east.host.bsky.network
invite_code_required
true
links
{ "privacyPolicy": "https://bsky.social/about/support/privacy-policy", "termsOfService": "https://bsky.social/about/support/tos" }
did
did:web:puffball.us-east.host.bsky.network
Raw Response 
{
  "did": "did:web:puffball.us-east.host.bsky.network",
  "availableUserDomains": [
    ".puffball.us-east.host.bsky.network"
  ],
  "inviteCodeRequired": true,
  "links": {
    "privacyPolicy": "https://bsky.social/about/support/privacy-policy",
    "termsOfService": "https://bsky.social/about/support/tos"
  },
  "contact": {}
}
🔒 The PDS hosts this identity's data. The PDS operator can see and serve all repository content.
▼
5

Repository Exploration

✓ success
121ms

Query the PDS for repository metadata. This shows which collections (post types) exist in the user's repo.

GET https://puffball.us-east.host.bsky.network/xrpc/com.atproto.repo.describeRepo?repo=did%3Aplc%3Az72i7hdynmk6r22z27h6tvur

Key Data

handle
bsky.app
did
did:plc:z72i7hdynmk6r22z27h6tvur
did_matches
true
collections
[ "app.bsky.actor.profile", "app.bsky.feed.generator", "app.bsky.feed.like", "app.bsky.feed.post", "app.bsky.feed.repost", "app.bsky.feed.threadgate", "app.bsky.graph.block", "app.bsky.graph.follow", "app.bsky.graph.list", "app.bsky.graph.listitem", "app.bsky.graph.starterpack", "app.bsky.graph.verification", "app.bsky.notification.declaration", "chat.bsky.actor.declaration" ]
handle_is_correct
true
Raw Response 
{
  "handle": "bsky.app",
  "did": "did:plc:z72i7hdynmk6r22z27h6tvur",
  "didDoc": {
    "@context": [
      "https://www.w3.org/ns/did/v1",
      "https://w3id.org/security/multikey/v1",
      "https://w3id.org/security/suites/secp256k1-2019/v1"
    ],
    "id": "did:plc:z72i7hdynmk6r22z27h6tvur",
    "alsoKnownAs": [
      "at://bsky.app"
    ],
    "verificationMethod": [
      {
        "id": "did:plc:z72i7hdynmk6r22z27h6tvur#atproto",
        "type": "Multikey",
        "controller": "did:p
...
🔒 The repository is a Merkle tree — content-addressed, tamper-evident, but the PDS chooses what to serve.
▼
6

Signing Key Verification

✓ success
0ms

Extract the atproto signing key from the DID document. This key signs every record in the repository, allowing anyone to verify data authenticity without trusting the PDS.

EXTRACT DID document verificationMethod field

Key Data

id
did:plc:z72i7hdynmk6r22z27h6tvur#atproto
type
Multikey
controller
did:plc:z72i7hdynmk6r22z27h6tvur
publicKeyMultibase
zQ3shQo6TF2moaqMTrUZEM1jeuYRQXeHEx4evX9751y2qPqRA
Raw Response 
{
  "id": "did:plc:z72i7hdynmk6r22z27h6tvur#atproto",
  "type": "Multikey",
  "controller": "did:plc:z72i7hdynmk6r22z27h6tvur",
  "publicKeyMultibase": "zQ3shQo6TF2moaqMTrUZEM1jeuYRQXeHEx4evX9751y2qPqRA"
}
🔒 Every record in the repository is signed with this key. Anyone can verify — you don't need to trust the PDS.

🔒 Trust Summary

Here's who you're trusting at each layer of the identity resolution:

  1. Hop 1 (Handle Resolution): You're trusting DNS and the domain operator to return the correct DID.
  2. Hop 2 (DID Document Fetch): For did:plc, you're trusting plc.directory. The DID document is signed but the directory is centralized.
  3. Hop 3 (Handle Verification (Bidirectional)): Bidirectional verification prevents handle hijacking — both sides must agree.
  4. Hop 4 (PDS Discovery): The PDS hosts this identity's data. The PDS operator can see and serve all repository content.
  5. Hop 5 (Repository Exploration): The repository is a Merkle tree — content-addressed, tamper-evident, but the PDS chooses what to serve.
  6. Hop 6 (Signing Key Verification): Every record in the repository is signed with this key. Anyone can verify — you don't need to trust the PDS.

Total resolution time: 384ms

View raw JSON