How to Set a Company Domain as Your Bluesky Handle: DNS TXT Records, the Well-Known File, Verification Badges and Impersonation

What Is a Bluesky Domain Handle?

A Bluesky domain handle is a username that is an internet domain you control, such as @example.com or @news.example.com, proven by a DNS record or a file on that domain’s website. Bluesky is a social network built on the AT Protocol (Authenticated Transfer Protocol), an open standard in which every account has a permanent identifier called a DID (decentralized identifier) and a changeable, human-readable handle. By default the handle ends in .bsky.social. When you switch it to your own domain, Bluesky checks the domain for your DID and shows the domain as your name.

For a company, this matters because anyone can create an account called “Example Corp,” but only the owner of example.com can make @example.com resolve. Bluesky’s 2023 tutorial says “This is one form of verification on Bluesky” and that “Websites have a long history of verification already, so using domains borrows their authority” (Bluesky). In April 2025 it added: “We highly encourage official organizations and individuals to do this because it links your web presence to your social account” (Bluesky).

How Do You Set a Domain Handle at a Glance?

You pick the domain, copy your DID from Bluesky, publish it in DNS, verify, and then check that it resolves. The table summarizes the steps.

Time: 10 to 20 minutes, plus DNS propagation (our estimate). Tools: a Bluesky account, DNS access. Cost: free if you own the domain. Skill level: beginner; the HTTPS method needs a developer.

What Do You Need Before Starting?

You need the Bluesky account’s login and edit access to the domain’s DNS. Bluesky’s tutorial notes that if your DNS host is different from your registrar, for example Cloudflare, you add the record at the DNS host (Bluesky). In most companies DNS sits with IT, the same team that sets the TXT records behind Google Search Console verification and SPF, DKIM and DMARC for outreach email. Agree the request with them first: a TXT record named _atproto does not affect the website or email.

Step 1: Confirm Who Controls the Domain

Use a domain the company owns outright and will keep renewing. The handle is only as durable as the domain. Bluesky’s tutorial says handles are revalidated periodically, and that if a handle becomes invalid the account’s data stays secure and the user can revalidate or pick a new handle (Bluesky). Avoid campaign or agency domains that may lapse.

Step 2: Choose the Handle

Use the root domain for the main company account and subdomains for people or divisions. Bluesky’s tutorial gives the subdomain example me.newspaper.com, for which the record name becomes “_atproto.me” (Bluesky). A company can give an executive @jane.example.com, which signals employment as clearly as an email address. The protocol rules on length and characters are short: only ASCII letters, digits and hyphens; segments “can not start or end with a hyphen”; and handles “are not case-sensitive, and should be normalized to lowercase” (AT Protocol).

The chart shows the limits are generous: any real company domain will fit, so the constraint in practice is readability.

Step 3: Open the Handle Settings in Bluesky

In the Bluesky app, open Settings, then Account, then Handle, and choose “I have my own domain.” Those are the labels in Bluesky’s tutorial, which says to open the left side menu, click “Settings,” then “Account,” then “Handle,” and on the “Change my handle” screen click “I have my own domain” (Bluesky). The tutorial dates from April 2023, so menu names may have moved; look for “Handle” under account settings. Enter the domain and Bluesky shows the record to add, including your DID. Bluesky says “The DID value is public and not sensitive information,” so it is safe to send to IT.

Step 4: Add the _atproto TXT Record

At your DNS host, create a TXT record with the name _atproto and the value did=did:plc:... exactly as Bluesky shows it. The tutorial’s instructions are: “Set the domain: _atproto,” “Set the type: TXT,” and use your own DID as the value, formatted “did=did:plc:” followed by your identifier (Bluesky). The specification describes the same thing: a TXT record “registered for the _atproto sub-domain under the handle hostname,” whose value has “the prefix did=, followed by the full DID” (AT Protocol).

Each account needs its own record with its own DID. Some DNS hosts add the domain automatically; if yours does, enter only _atproto or _atproto.news as the name.

Step 5: Verify and Save

Wait a few minutes, then select “Verify DNS Record” and save the new handle. Bluesky’s tutorial says to wait a couple of minutes for the change to propagate and notes that DNS propagation can take longer (Bluesky). Once saved, Bluesky says “Any tags or mentions with your old handle will still point to your account,” so earlier posts that mention the .bsky.social handle keep working.

Step 6: Use the Well-Known File Instead, if DNS Is Hard to Change

A developer can prove the handle by serving the DID as plain text at https://yourdomain/.well-known/atproto-did. Bluesky’s tutorial says the route must return the DID with “content-type text/plain” and that handle resolution “explicitly expects a HTTP 200 OK status” (Bluesky). The specification adds that “Secure HTTPS on the default port (443) is required” (AT Protocol). This suits subdomains where IT will not add records, but a redesign that drops the file will break the handle.

Step 7: Record It and Protect the Domain

Write down which accounts use which records, and keep the domain renewed. Our recommendation, not a Bluesky rule: keep a short register of each handle, its DID, who requested it and the date, alongside your other social account records. If someone leaves the company, change their handle back to .bsky.social or to a personal domain, then delete the subdomain record, so the company name stops appearing on an account it no longer controls.

Which Company Accounts Should Use the Domain?

Give the domain to accounts the company controls and speaks through, and keep personal accounts on personal handles. Our recommendation, not a Bluesky rule, follows the same logic as company email addresses:

The same domain-based identity carries across other apps built on the AT Protocol, Bluesky’s tutorial says, so a subdomain handed out for Bluesky is effectively a company credential on that network and should be reviewed like one.

How Is a Domain Handle Different From a Blue Check?

A domain handle is self-serve proof of domain control; a blue badge is granted by Bluesky or a Trusted Verifier. In April 2025 Bluesky said it “will proactively verify authentic and notable accounts and display a blue badge next to their names,” and that “select independent organizations can verify accounts directly,” shown with scalloped badges. It described a domain handle as “different from a verification badge,” and said “Domain handles continue to be an important part of verification on Bluesky.” Notable accounts can apply for a badge through a form linked in that post (Bluesky). The post gives no detailed criteria beyond authenticity and notability, so we do not suggest any. Our guide on getting verified on LinkedIn covers the equivalent there.

How to Verify It Worked

Open the profile while logged out and check that the handle shows your domain without a warning. Then look up the TXT record with a DNS lookup tool, and visit the well-known URL if you used that method; it should return only the DID. Search Bluesky for the company name to see whether lookalike accounts remain.

Common Problems and Fixes

What Should You Do About an Impersonating Account?

Report it in the app, and point to your domain handle as proof of the real account. Bluesky’s community guidelines say users may not “impersonate others or official groups in ways that could mislead users” or “create fake accounts to deceive others about who you are,” while “Clearly labeled parody, satire, or fan accounts” are allowed (Bluesky, last updated September 19, 2025). The guidelines page does not describe the reporting steps, so use the report option on the profile. For impersonation in paid ads, see our guide on reporting a scam ad impersonating your company.

What Not to Do

Do not put an executive on the root domain. Consequence: the company’s main identity follows one person. Correction: use a subdomain.

Do not delete the TXT record during a DNS clean-up. Consequence: the handle becomes invalid. Correction: label it in your DNS notes.

Do not describe a domain handle as a “verified” badge in press materials. Consequence: it overstates what Bluesky has checked. Correction: say the account uses the company’s domain.

Frequently Asked Questions

Sources and Methodology

This guide is built from Bluesky’s 2023 domain-handle tutorial, its April 2025 verification announcement and its community guidelines, and the AT Protocol handle specification, all read October 27, 2026. Bluesky’s tutorial is from 2023, so menu labels may differ in the current app; we note this where it matters. Time estimates, subdomain and offboarding advice are our recommendations. We did not change a handle for this guide.

1. platform documentation Bluesky, How to verify your Bluesky account. Steps, record format, well-known method, quotes. Read October 27, 2026.
2. platform documentation Bluesky, A New Form of Verification on Bluesky. Badges, Trusted Verifiers, 270,000 figure. Read October 27, 2026.
3. standards AT Protocol, Handle. Length, characters, resolution. Read October 27, 2026.
4. platform documentation Bluesky, Community Guidelines. Impersonation and parody rules. Read October 27, 2026.