diff --git a/gen-test.js b/gen-test.js
index 1ec0ea9..1c9dc7d 100644
--- a/gen-test.js
+++ b/gen-test.js
@@ -54,7 +54,7 @@ const dereferencerInputs = [
     dereferenceOptions: {}
   },
   {
-    didUrl: 'did:ssb:ed25519:f_6sQ6d2CMxRUhLpspgGIulDxDCwYD7DzFzPNr7u5AU?versionTime=2021-07-24T03:38:46Z',
+    didUrl: 'did:ssb:ed25519:f_6sQ6d2CMxRUhLpspgGIulDxDCwYD7DzFzPNr7u5AU?versionTime=2021-07-24T03:38:45Z',
     dereferenceOptions: {}
   }
 ];
diff --git a/resolver.js b/resolver.js
index 345a170..631d14a 100644
--- a/resolver.js
+++ b/resolver.js
@@ -16,6 +16,7 @@ const didRe = /^did:ssb:(ed25519):([0-9a-zA-Z._\-]+)$/;
 const didUrlRe = /^(did:[^?#\/]*)(?:\/([^?#]*))?(?:\?([^#]*))?(?:#(.*))?$/;
 const ssbRefRe = /^(@|%|&)([A-Za-z0-9\/+]{43}=)\.([\w\d]+)$/;
 const ssbMsgIdRe = /^%[A-Za-z0-9\/+]{43}=\.[\w\d]+$/;
+const dateTimeRe = /^\d\d\d\d-\d\d-\d\dT\d\d:\d\d:\d\dZ$/;
 
 function parseDIDURL(uri) {
   const m = didUrlRe.exec(uri);
@@ -100,7 +101,9 @@ Resolver.prototype.resolveOrResolveRepresentation = function (did, resolutionOpt
       gotLatestMessage();
     });
   } else if (versionTime) {
+    if (!dateTimeRe.test(versionTime)) return cb({error: 'invalidVersionTime'}, Null, {});
     const versionDate = new Date(versionTime);
+    const timestampQuery = {$lte: versionDate.getTime() + 1000};
     // 5
     pull(
       self.sbot.query.read({
@@ -111,7 +114,7 @@ Resolver.prototype.resolveOrResolveRepresentation = function (did, resolutionOpt
             value: {
               author: feedId,
               content: {type: 'did-document-update'},
-              timestamp: {$lte: versionDate.getTime()}
+              timestamp: timestampQuery
             }
           }}
         ]