Punycode (xn--) Email Domains Explained: IDN Routing & Homograph Safety

Many legitimate websites and businesses around the world use domain names containing accented or non-Latin characters—such as münchen.de or café.example. Behind the scenes, however, core DNS infrastructure still operates on plain ASCII (a–z, 0–9, and -).

Punycode (defined in RFC 3492) bridges that gap for Internationalized Domain Names (IDNs).

How Punycode Encodes Non-ASCII Domains

Whenever a domain label contains non-ASCII characters, applications convert that label into an ASCII-Compatible Encoding (ACE) string prefixed with xn--:

• münchen.de becomes xn--mnchen-3ya.de
• café.com becomes xn--caf-dma.com

Each dot-separated label is converted independently, while pure ASCII labels (like .de or .com) remain unchanged. Crucially, both spellings refer to the exact same DNS zone and mail server.

Practical Compatibility Tips for IDN Email Addresses

While modern mail servers (Postfix, Dovecot, Gmail, Outlook) support IDN/SMTPUTF8 extensions, older web registration forms often validate email addresses with naive ^[a-z0-9._+-]+@[a-z0-9.-]+$ regular expressions:

• If a signup form rejects accented characters: Enter the xn-- ASCII form of the domain instead—mail routes to the identical destination.
• Watch out for copy-paste encoding issues: Legacy ticketing systems occasionally corrupt Unicode characters; ASCII xn-- labels survive every plain-text pipeline intact.
• Plain ASCII domains maximize compatibility: All default domains on Email Generator use clean ASCII .my.id and standard zones so web forms never stumble over character encoding.

Security Warning: IDN Homograph Phishing Attacks

Because Cyrillic а (U+0430), Greek ο (U+03BF), and Latin a/o look identical in many fonts, attackers sometimes register look-alike domains that visually mimic trusted brands.

How to Spot a Homograph Disguise Instantly 1. Inspect the `xn--` representation: A genuine ASCII brand like apple.com or paypal.com never starts with xn--. If a link pretending to be an ASCII brand resolves to xn--pple-43d.com, it is a spoof! 2. Rely on Browser Address Bars: Chrome, Firefox, and Safari automatically display raw xn-- Punycode whenever a domain mixes scripts suspiciously. 3. Never enter passwords via unexpected email links: Navigate to critical accounts directly via bookmarks.