Why domains need Punycode
DNS only carries letters, digits and hyphens in ASCII. To allow names like münchen.de or 日本語.jp, each non-ASCII label is encoded into an ASCII string starting with xn--. Browsers show the Unicode form and resolve the ASCII one; certificates, zone files and most APIs want the ASCII form. The encoding is Punycode (RFC 3492), and the rules for which characters are allowed and how they are normalised are IDNA (RFC 5890–5895, UTS 46).
How Punycode works
- Copy the ASCII characters of the label as they are, followed by a hyphen if there were any:
mnchen-. - Encode the positions and code points of the non-ASCII characters as a sequence of base-36 digits (a–z, 0–9) with a variable-length scheme that keeps common cases short:
3yasays “insert ü after the first character”. - Prefix with
xn--:xn--mnchen-3ya.
The result is case-insensitive and at most 63 bytes per label, like any DNS label.
Homograph attacks
Because Cyrillic а, е, о, р, с look like Latin letters, xn--80ak6aa92e.com renders as a convincing apple.com. Browsers now show the xn-- form when a label mixes scripts or uses confusable characters, and registries restrict which scripts can be combined. The converter warns when a label mixes scripts for the same reason.
Where you will meet it
TLS certificates (the SAN must contain the xn-- form), SPF and DKIM records, email addresses (ü@example.de needs SMTPUTF8 and is separate from IDN), URLs in logs, and dig, which prints the ASCII form.
Questions
What does xn-- mean?
It is the ACE prefix marking a Punycode-encoded label. Any DNS label starting with xn-- is an internationalised name in ASCII form.
Do I use the Unicode or the xn-- form in a certificate?
The xn-- form, in both the CN (if used) and the subjectAltName. Let’s Encrypt and other CAs accept the Unicode form in the request and convert it.
Why does my converter give a different result for uppercase?
IDNA maps names to lowercase and NFC before encoding, so MÜNCHEN.de and münchen.de give the same xn-- label. This tool applies the same mapping.
Can email addresses be internationalised?
The domain part uses Punycode as for any domain. The local part before @ can be UTF-8 only with SMTPUTF8 (RFC 6531), which not all mail servers support; there is no Punycode for it.