2026-09-10 · 6 min read · Rahul Chitturi
- url
- idna
- dns
An internationalized domain name may appear as readable Unicode in a UI and as xn-- Punycode labels in DNS or network logs. Failures arise when components apply different IDNA profiles, normalize separators differently, or encode an entire URL instead of processing host labels.
Punycode alone is not the full validation algorithm. IDNA mapping, normalization, contextual rules, label limits, and disallowed code points determine whether a Unicode label can become an ASCII lookup label.
Capture both host representations
With a harmless domain fixture, record the original input, parsed hostname, Unicode display form, ASCII A-label form, final DNS query, certificate name, and redirect target. Compare components rather than copying the address bar display.
- Split the scheme, authority, port, path, query, and fragment first.
- Convert each domain label through the intended IDNA implementation.
- Check dot-like separators, trailing dots, and empty labels.
- Preserve percent-encoding as a separate URL-layer concern.
Align the application and resolver profile
Use the platform URL parser and a maintained IDNA implementation appropriate to the protocol. Browsers commonly apply compatibility processing that can differ from strict IDNA2008 libraries, so test exact runtime versions and reject conversion errors instead of sending an unintended hostname.
For allowlists and security decisions, compare a documented canonical ASCII host after parsing. Unicode lookalikes remain a user-interface and registration risk even when conversion is technically valid.
Inspect public domains with Flashman
Use the URL tool to separate components, diff to compare Unicode and ASCII host forms, case converter for synthetic casing checks, and number-base converter to inspect suspect code points. Remove credentials, tokens, and private query data before using browser tools.
Test mixed scripts, combining marks, sharp s, final sigma, joiners, dot variants, uppercase input, long labels, trailing dots, redirects, cookies, certificate matching, and every browser, server, and DNS library in the request path.