IDN, Punycode and mixed-script domains
Read internationalized domain names safely without treating every non-ASCII label as suspicious.
Definition and scope
Read internationalized domain names safely without treating every non-ASCII label as suspicious.
Use this reference to establish the meaning and limits of the result before changing production configuration.
How it works
DNS transports internationalized labels as ASCII Compatible Encoding beginning xn--. Applications decode them to Unicode for people. Punycode is an encoding, not a reputation or security verdict.
How to read it
Compare both Unicode and ASCII forms. Mixed Latin, Cyrillic or Greek letters can make distinct labels look alike, but multilingual names may be legitimate. Script detection is therefore an attention signal only.
Correct and incorrect examples
Compare the normalized examples. Technical values are illustrative and use documentation ranges or reserved names.
xn--e1afmkfd.xn--p1ai ↔ пример.рфmixed_script = phishing| Element | Role | Example |
|---|---|---|
| Unicode | U-label | пример.рф |
| Punycode | A-label | xn--e1afmkfd.xn--p1ai |
| Script | heuristic | Latin / Cyrillic / Greek |
| Verdict | context | mixed_script ≠ phishing |
Common problems
Copying a visually similar label, hiding the ASCII form, and claiming that mixed scripts prove phishing create errors. Registries and browsers apply additional policies that a simple checker cannot reproduce completely.
Practical checklist
Verify the exact code points, registration source, certificate and organizational context before trusting a name. Preserve the xn-- form in logs and technical reports.
Standards and primary references
These primary specifications define the protocol behavior. Provider documentation may add operational requirements but cannot replace the standard.