---
aimd: "1.0"
mako: "1.0"
type: "article"
entity: "How the verifier works"
updated: "2026-09-16"
tokens: 224
language: "en"
canonical: "https://verify.aifeed.md/how-it-works"
summary: "The six checks, in order, and why each one matters."
alternates:
  - url: "https://verify.aifeed.md/how-it-works/"
    lang: "en"
  - url: "https://verify.aifeed.md/id/how-it-works/"
    lang: "id"
media:
  cover:
    url: "https://aifeed.md/og-image.png"
    alt: "How the verifier works"
---

[Home](/) / How it works

# Six checks, in order

- Discovery. Fetch /.well-known/ai.json , or follow the ai-feed link relation.

- Strict parse. Duplicate keys, floats, and out-of-range integers are rejected before any crypto runs.

- Domain binding. The manifest's identity.domain must equal the host you asked for.

- Signature. Ed25519 over JCS-canonical bytes with the aifeed.v0.2 separation.

- DNS anchor. A DNS-over-HTTPS lookup of _aifeed.<host> must carry the same public key.

- Permissions and revocation. The usage table is read, and the registry document is checked when present.

## A sample trace

```
PASS discovery https://demo.aifeed.md/.well-known/ai.json
PASS parse duplicate keys, floats, bounds clean
PASS domain demo.aifeed.md
PASS signature ed25519 over aifeed.v0.2
PASS anchor v=aifeed1 · fp=sha256:NQixB-4Q…
PASS content text/aifeed+markdown · signature verified
```

## Honest limits

- The verifier proves provenance, not that the markdown faithfully mirrors the HTML rendering.

- First-contact origin+DNS compromise is undetectable without out-of-band state.

- WebCrypto Ed25519 support is required; older browsers get a clear warning instead of a false pass.