netky:~#

how it works

Netky lists the Pubky homeservers it can find and checks them every five minutes. It is an independent observer, not run by Synonym, and it trusts no one's word about where a user lives: every link comes from a record signed by the key itself.

$ discovery

The Mainline DHT cannot be listed: you need a key to read a record. So Netky starts from users.

  1. It lists user keys from Nexus, the pubky.app indexer, every six hours.
  2. For each user it reads their PKARR record and follows the _pubky entry, which names their homeserver. The signature is checked locally, so the relay serving the record cannot forge it.
  3. It then reads each homeserver's own record to learn its domain, ports and addresses.

Limit: a homeserver with no user known to Nexus stays invisible. Netky shows the part of the network that is actually used, not every server that exists.

$ checks

Only what a normal client would do, nothing more:

  • one HTTPS request on the root page every five minutes (latency, status, server header);
  • a plain TCP connect for servers that only publish a Pubky TLS port;
  • one TLS handshake every six hours to read the certificate;
  • one request to /signup_tokens/… every six hours with a dummy token, to learn whether signups are open or invite only. Nothing is ever signed up.

No port scan, no load test, no attempt to log in. Requests carry the user agent netky/0.1 (+https://netky.pubky.pastalabs.dev/about). Checks run from a single place, so latency is measured from the Netherlands.

Location comes from DB-IP's free databases, read locally: no address is sent to a third party. Only the country and network are kept, never a city. Servers behind a CDN such as Cloudflare are shown as such, since their IP only says where the CDN answered.

$ claim your homeserver

A claim links a homeserver to its operator's Pubky key. It has two sides: one proves you control the server, the other that the key you name agrees.

1. The server. On the domain your homeserver announces (the one shown on its Netky page), add a DNS record:

_netky.<your homeserver domain>  TXT  "operator=<your pubky key>"

That domain comes from the homeserver's own signed record, so only whoever runs the server can set it. If you publish the homeserver's PKARR record yourself, a _netky TXT "operator=<key>" in that record works too. A stock homeserver rewrites its record every hour, so for most people DNS is the way.

2. The operator. From your own Pubky account, confirm by publishing a public file that lists the homeservers you run, one key per line:

pubky://<your pubky key>/pub/netky/operates.txt

A _netky TXT "operates=<homeserver key>" in your own PKARR record works too. Until then, the server shows as claimed with the operator "not confirmed".

Netky picks changes up within the hour. To revoke a claim, remove the DNS record. The pubky prefix on keys is optional.

$ api

Everything on the site is available as JSON, free to use:

GET /api/v1/homeservers
GET /api/v1/homeservers/<pubkey>
GET /api/v1/stats

$ contact

Something wrong about your server, or want it excluded? Open an issue on GitHub. The code is open source.