← New trace

Tracing @jay.bsky.team

6 hops · 396ms total

1

Handle Resolution

✓ success
190ms

Resolve the handle "jay.bsky.team" to a DID. First tries HTTPS well-known, then falls back to DNS TXT record. Method used: DNS TXT _atproto.

GET DNS TXT _atproto.jay.bsky.team

Key Data

did
did:plc:oky5czdrnfjpqslsw2a5iclo
method
DNS TXT _atproto
Raw Response 
{
  "Status": 0,
  "TC": false,
  "RD": true,
  "RA": true,
  "AD": true,
  "CD": false,
  "Question": [
    {
      "name": "_atproto.jay.bsky.team",
      "type": 16
    }
  ],
  "Answer": [
    {
      "name": "_atproto.jay.bsky.team",
      "type": 16,
      "TTL": 14400,
      "data": "\"did=did:plc:oky5czdrnfjpqslsw2a5iclo\""
    }
  ]
}
🔒 You're trusting DNS and the domain operator to return the correct DID.
▼
2

DID Document Fetch

✓ success
87ms

Fetch the DID document for did:plc:oky5czdrnfjpqslsw2a5iclo. Using plc.directory (centralized DID registry).

GET https://plc.directory/did:plc:oky5czdrnfjpqslsw2a5iclo

Key Data

id
did:plc:oky5czdrnfjpqslsw2a5iclo
alsoKnownAs
at://jay.bsky.team
verification_methods_count
1
services_count
1
Raw Response 
{
  "@context": [
    "https://www.w3.org/ns/did/v1",
    "https://w3id.org/security/multikey/v1",
    "https://w3id.org/security/suites/secp256k1-2019/v1"
  ],
  "id": "did:plc:oky5czdrnfjpqslsw2a5iclo",
  "alsoKnownAs": [
    "at://jay.bsky.team"
  ],
  "verificationMethod": [
    {
      "id": "did:plc:oky5czdrnfjpqslsw2a5iclo#atproto",
      "type": "Multikey",
      "controller": "did:plc:oky5czdrnfjpqslsw2a5iclo",
      "publicKeyMultibase": "zQ3shtJpFGgEG3tv3ERKvjo7VHbjDPVyvjYvW7gpie49rtN
...
🔒 For did:plc, you're trusting plc.directory. The DID document is signed but the directory is centralized.
▼
3

Handle Verification (Bidirectional)

✓ success
0ms

Check that the DID document's alsoKnownAs field contains "at://jay.bsky.team". Handle resolved to DID (hop 1) and DID document lists handle (hop 2) must agree.

VERIFY DID document alsoKnownAs field

Key Data

expected_handle
jay.bsky.team
did_document_handles
jay.bsky.team
bidirectional_match
true
🔒 Bidirectional verification prevents handle hijacking — both sides must agree.
▼
4

PDS Discovery

✓ success
99ms

Found PDS at https://morel.us-east.host.bsky.network. Verified it's reachable by calling describeServer.

GET https://morel.us-east.host.bsky.network/xrpc/com.atproto.server.describeServer

Key Data

pds_endpoint
https://morel.us-east.host.bsky.network
available_user_domains
.morel.us-east.host.bsky.network
invite_code_required
true
links
{ "privacyPolicy": "https://bsky.social/about/support/privacy-policy", "termsOfService": "https://bsky.social/about/support/tos" }
did
did:web:morel.us-east.host.bsky.network
Raw Response 
{
  "did": "did:web:morel.us-east.host.bsky.network",
  "availableUserDomains": [
    ".morel.us-east.host.bsky.network"
  ],
  "inviteCodeRequired": true,
  "links": {
    "privacyPolicy": "https://bsky.social/about/support/privacy-policy",
    "termsOfService": "https://bsky.social/about/support/tos"
  },
  "contact": {}
}
🔒 The PDS hosts this identity's data. The PDS operator can see and serve all repository content.
▼
5

Repository Exploration

✓ success
20ms

Query the PDS for repository metadata. This shows which collections (post types) exist in the user's repo.

GET https://morel.us-east.host.bsky.network/xrpc/com.atproto.repo.describeRepo?repo=did%3Aplc%3Aoky5czdrnfjpqslsw2a5iclo

Key Data

handle
jay.bsky.team
did
did:plc:oky5czdrnfjpqslsw2a5iclo
did_matches
true
collections
[ "app.bsky.actor.profile", "app.bsky.feed.like", "app.bsky.feed.post", "app.bsky.feed.postgate", "app.bsky.feed.repost", "app.bsky.feed.threadgate", "app.bsky.graph.block", "app.bsky.graph.follow", "at.youandme.connection", "blue.flashes.actor.profile", "chat.bsky.actor.declaration", "club.feeed.submission", "site.standard.document", "site.standard.publication" ]
handle_is_correct
true
Raw Response 
{
  "handle": "jay.bsky.team",
  "did": "did:plc:oky5czdrnfjpqslsw2a5iclo",
  "didDoc": {
    "@context": [
      "https://www.w3.org/ns/did/v1",
      "https://w3id.org/security/multikey/v1",
      "https://w3id.org/security/suites/secp256k1-2019/v1"
    ],
    "id": "did:plc:oky5czdrnfjpqslsw2a5iclo",
    "alsoKnownAs": [
      "at://jay.bsky.team"
    ],
    "verificationMethod": [
      {
        "id": "did:plc:oky5czdrnfjpqslsw2a5iclo#atproto",
        "type": "Multikey",
        "controlle
...
🔒 The repository is a Merkle tree — content-addressed, tamper-evident, but the PDS chooses what to serve.
▼
6

Signing Key Verification

✓ success
0ms

Extract the atproto signing key from the DID document. This key signs every record in the repository, allowing anyone to verify data authenticity without trusting the PDS.

EXTRACT DID document verificationMethod field

Key Data

id
did:plc:oky5czdrnfjpqslsw2a5iclo#atproto
type
Multikey
controller
did:plc:oky5czdrnfjpqslsw2a5iclo
publicKeyMultibase
zQ3shtJpFGgEG3tv3ERKvjo7VHbjDPVyvjYvW7gpie49rtNtc
Raw Response 
{
  "id": "did:plc:oky5czdrnfjpqslsw2a5iclo#atproto",
  "type": "Multikey",
  "controller": "did:plc:oky5czdrnfjpqslsw2a5iclo",
  "publicKeyMultibase": "zQ3shtJpFGgEG3tv3ERKvjo7VHbjDPVyvjYvW7gpie49rtNtc"
}
🔒 Every record in the repository is signed with this key. Anyone can verify — you don't need to trust the PDS.

🔒 Trust Summary

Here's who you're trusting at each layer of the identity resolution:

  1. Hop 1 (Handle Resolution): You're trusting DNS and the domain operator to return the correct DID.
  2. Hop 2 (DID Document Fetch): For did:plc, you're trusting plc.directory. The DID document is signed but the directory is centralized.
  3. Hop 3 (Handle Verification (Bidirectional)): Bidirectional verification prevents handle hijacking — both sides must agree.
  4. Hop 4 (PDS Discovery): The PDS hosts this identity's data. The PDS operator can see and serve all repository content.
  5. Hop 5 (Repository Exploration): The repository is a Merkle tree — content-addressed, tamper-evident, but the PDS chooses what to serve.
  6. Hop 6 (Signing Key Verification): Every record in the repository is signed with this key. Anyone can verify — you don't need to trust the PDS.

Total resolution time: 396ms

View raw JSON