Bluesky handle checker

Set up your own domain as a Bluesky handle and it isn't working? Enter it below. This page looks it up the way Bluesky's servers do and tells you what's wrong.

How Bluesky checks a domain handle

A domain handle works only when both directions agree:

1. Domain → account. Bluesky looks up a DNS TXT record at _atproto. + your domain, for example _atproto.alice.example.com. Its value must be did= followed by your account's DID, like did=did:plc:abc123…. If there's no usable record, it tries https://your domain/.well-known/atproto-did, a plain text file whose first line is the DID. DNS is checked first and wins if both exist.
2. Account → domain. Your account's DID document (for most people at plc.directory) must list at:// + your domain. That happens when you change your handle in the app and press verify.

These are the rules in Bluesky's own resolver (HandleResolver in @atproto/identity); this page follows them line by line, and its handle syntax check matches @atproto/syntax (compared on 30,000 random strings).

Most common mistakes

• The domain typed twice. Most DNS panels add your domain to the name automatically. Typing _atproto.example.com there creates _atproto.example.com.example.com. Type just _atproto (or _atproto.alice for alice.example.com). This page looks for the doubled name too.
• Two did= records. If _atproto has more than one TXT record starting with did=, Bluesky ignores all of them, even if they're identical. Keep exactly one. This happens a lot to organisations with a second account (a sports desk, a language edition): that account's record gets added at the main _atproto name instead of its own, like _atproto.sports, and the main handle goes invalid. This page looks up each DID and tells you which one to keep.
• Missing or misspelled prefix. The value must start with exactly did= (lower case, no spaces). did:plc:… alone, or DID=…, doesn't count.
• Record on the wrong name. A TXT record on the domain itself (host @) is not looked at.
• The .well-known file returns your home page. Many site builders answer every unknown path with HTML. The first line has to be the DID itself.
• "Invalid handle" after everything is right. Bluesky caches the result of its last check. Once both directions check out here, saving the handle again in the app usually clears it.

It worked for months and now says "Invalid Handle"

Bluesky re-checks domain handles from time to time, so a handle can break long after it was set up. Run a check above, then:

• The check says the domain does not exist. The registration has almost certainly expired (or the name is misspelled). Renew it at your registrar; once it is back, check again and re-add the TXT record if it's gone.
• The check says the domain looks parked or for sale. The domain still exists, but its nameservers now belong to a parking or domain-marketplace service. Usually the registration lapsed and the domain was parked or resold. Check whether you still own it. If you do, point the nameservers back to your DNS host and re-add the record; if not, the handle can't come back, so pick a new one (your posts and followers stay with your account).
• The check says _atproto is an alias (CNAME). A wildcard * record now answers for every name on the domain, often one the registrar added for parking or URL forwarding, and it hides the missing TXT record. Adding an exact TXT record at _atproto wins over the wildcard. On a shared subdomain service, only the domain's owner can fix the wildcard.
• The check finds no record. Usually the domain moved to a new DNS host or site builder and the _atproto TXT record wasn't copied over. Add it again (the second box above gives you the exact value).
• The handle uses only the .well-known file. Then it depends on your website. If the site (or the hosting service it lives on) is down or slow when Bluesky re-checks, the handle goes invalid until the next check. A DNS TXT record avoids that.
• The check says "All good". Nothing is wrong now; an earlier check failed, possibly on Bluesky's side. In early November 2026 several people posted that long-standing domain handles had suddenly turned invalid; the ones I looked up resolved fine again. To force a fresh check: Settings → Account → Handle → "I have my own domain", enter the same domain, verify, then "Update to …".

Where do I find my DID?

Put your current handle (for example you.bsky.social) in the second box above and run a check: the table shows the exact TXT value to use. The Bluesky app also shows it while you change your handle to a domain.

How long does DNS take?

Usually minutes, sometimes up to an hour or more, depending on your provider and the record's TTL. This page asks Cloudflare's public DNS (or Google's if that fails), which may see a change slightly before or after Bluesky does.

What this page sends, and limits

• To check, your browser asks: Cloudflare or Google DNS-over-HTTPS (for the TXT records, and the domain's nameservers if no record is found), your domain (/.well-known/atproto-did), plc.directory (DID document), and Bluesky's public API (public.api.bsky.app). Nothing goes to me; there is no server behind this page.
• Most websites don't allow other sites to read their files, so the browser often can't see your .well-known file. That's fine: Bluesky isn't a browser. In that case this page relies on what Bluesky's public API reports.
• did:web accounts are checked through https://host/.well-known/did.json, which has the same browser limit.
• The "Bluesky shows" line is the public API's cached view, so it can lag behind a fix by a while.