IDN and Punycode

An internationalized domain name (IDN) is a domain containing characters outside basic ASCII, such as accents or non-Latin scripts. DNS itself only handles ASCII labels, so each such label is converted with Punycode into an ASCII string prefixed with xn--.

Why it matters

IDNs let people use their own language in a domain, but they create a security issue: different scripts have lookalike characters. A Cyrillic "a" can be indistinguishable from a Latin "a", enabling homograph phishing. Browsers apply display rules, showing the xn-- form when a name mixes scripts suspiciously. When you check DNS, WHOIS or certificates, you must use the encoded form.

Example

münchen.example   ->  xn--mnchen-3ya.example

$ dig xn--mnchen-3ya.example A

The browser shows the readable name, but the resolver and certificate only see the ASCII version. Registries publish language tables that limit which characters are allowed.

Common mistakes

• Pasting the Unicode name into a DNS tool that does not convert it.
• Trusting a name just because it looks right in the address bar.
• Forgetting to register obvious lookalike variants of a brand.

Related

• Domain name
• Typosquatting
• Phishing
• UTF-8

This page is general information written by our editorial team and updated when documentation changes. Servers and providers differ, so test changes safely first. See our editorial policy and disclaimer.