Function resolve_handle 

pub(crate) async fn resolve_handle(
    __arg0: State<AppState>,
    peer: Peer,
    headers: HeaderMap,
    query: Result<Query<ResolveHandleQuery>, QueryRejection>,
) -> Response

GET /xrpc/com.atproto.identity.resolveHandle?handle=

The DID a handle points at. A handle an account here holds answers what /.well-known/atproto-did answers on that hostname, so this route is as public as that one. Any other handle under this deployment’s own domains is HandleNotFound at once.

Every other handle is resolved the way the handle spec says: the _atproto TXT record, then https://<handle>/.well-known/atproto-did. That fetch refuses private addresses, is bounded by crate::handles::LOOKUP_TIMEOUT, and spends one of the caller’s HANDLE_LOOKUP_LIMIT lookups. A handle under a TLD the spec reserves is never looked up. A lookup that finds no DID, fails or times out is HandleNotFound. Like the lexicon says, the DID is not checked back against its document.