Punycode and xn-- domains: homograph lookalikes

Domain names can contain letters from any alphabet: bücher.de, пример.рф. DNS itself only handles plain ASCII, so these names are stored in an encoded form called punycode, which always starts with xn--:

bücher.de   →  xn--bcher-kva.de

That's useful for the billions of people who don't write in Latin letters. It also lets someone register a name that looks like yours but uses a letter from another alphabet: a homograph.

The trick

The Cyrillic letter а (U+0430) looks identical to the Latin a in most fonts. Swap one for the other and you get a different domain that reads the same:

аpple.com   (Cyrillic а)  →  xn--pple-43d.com
аррӏе.com   (all Cyrillic) →  xn--80ak6aa92e.com

The second one was a real demonstration in 2017: browsers showed it as "apple.com" in the address bar. Other common lookalikes are Cyrillic е, о, р, с, х and у, and Greek ο.

What browsers show you

Browsers now decide, label by label, whether to show the Unicode form or the xn-- form:

Chrome shows punycode when a label mixes scripts that are easy to confuse (Latin with Cyrillic or Greek), when an all-Cyrillic label looks like Latin under a non-Cyrillic TLD such as .com, and when the name looks like a well-known domain. It can also show a full-page "did you mean" warning.
Firefox shows punycode unless every character in a label comes from one script (Latin may combine with some scripts, but not Cyrillic or Greek).

So in a browser address bar, a homograph of your domain usually shows up as xn--... today. That protection doesn't extend everywhere: email clients, chat apps, PDFs and documents may display the Unicode form and look exactly like your name.

What registries allow

Registries add their own rules. ICANN's IDN guidelines say the characters in one label should come from a single script, and Verisign rejects .com names that mix scripts. So аpple.com with one Cyrillic letter can't be registered in .com, but an all-Cyrillic lookalike can, and rules differ across the hundreds of other TLDs.

How to check a suspicious name

xn-- anywhere in a link means the label is encoded. Decode it to see the real characters.
Decode with any IDNA converter, or in Python: "xn--pple-43d".encode().decode("idna").
Copy the name into a plain-text editor with a monospace font, or search for it: a homograph usually won't match your real domain.
If you received email from it, check the sending domain in the headers, where it appears in xn-- form.

What to do if someone registered one of yours

Treat it like any other lookalike: warn the people it's likely to target (warning email templates), block it at your mail gateway, and report it to the registrar (report a lookalike domain). Registrars generally act faster when the domain is serving phishing or sending mail, so collect evidence of use.

Check your domain

The lookalike domain checker tries single-letter Cyrillic swaps of your domain along with typos and added words, and shows which are registered and can send email. Nameward's monitoring also matches newly registered domains, including xn-- names, against yours every day.

Punycode and xn-- domains: how homograph lookalikes work