# Punycode and xn-- domains: how homograph lookalikes work

Domain names can contain letters from any alphabet: `bücher.de`,
`пример.рф`. DNS itself only handles plain ASCII, so these names are
stored in an encoded form called **punycode**, which always starts with
`xn--`:

```
bücher.de   →  xn--bcher-kva.de
```

That's useful for the billions of people who don't write in Latin
letters. It also lets someone register a name that **looks** like yours
but uses a letter from another alphabet: a homograph.

## The trick

The Cyrillic letter `а` (U+0430) looks identical to the Latin `a` in most
fonts. Swap one for the other and you get a different domain that reads
the same:

```
аpple.com   (Cyrillic а)  →  xn--pple-43d.com
аррӏе.com   (all Cyrillic) →  xn--80ak6aa92e.com
```

The second one was a real demonstration in 2017: browsers showed it as
"apple.com" in the address bar. Other common lookalikes are Cyrillic `е`,
`о`, `р`, `с`, `х` and `у`, and Greek `ο`.

## What browsers show you

Browsers now decide, label by label, whether to show the Unicode form or
the `xn--` form:

- **Chrome** shows punycode when a label mixes scripts that are easy to
  confuse (Latin with Cyrillic or Greek), when an all-Cyrillic label looks
  like Latin under a non-Cyrillic TLD such as `.com`, and when the name
  looks like a well-known domain. It can also show a full-page "did you
  mean" warning.
- **Firefox** shows punycode unless every character in a label comes from
  one script (Latin may combine with some scripts, but not Cyrillic or
  Greek).

So in a browser address bar, a homograph of your domain usually shows up
as `xn--...` today. That protection doesn't extend everywhere: email
clients, chat apps, PDFs and documents may display the Unicode form and
look exactly like your name.

## What registries allow

Registries add their own rules. ICANN's IDN guidelines say the characters
in one label should come from a single script, and Verisign rejects `.com`
names that mix scripts. So `аpple.com` with one Cyrillic letter can't be
registered in `.com`, but an **all-Cyrillic** lookalike can, and rules
differ across the hundreds of other TLDs.

## How to check a suspicious name

- **`xn--` anywhere in a link** means the label is encoded. Decode it to
  see the real characters.
- Decode with any IDNA converter, or in Python:
  `"xn--pple-43d".encode().decode("idna")`.
- Copy the name into a plain-text editor with a monospace font, or search
  for it: a homograph usually won't match your real domain.
- If you received email from it, check the sending domain in the headers,
  where it appears in `xn--` form.

## What to do if someone registered one of yours

Treat it like any other lookalike: warn the people it's likely to target
([warning email templates](/guides/lookalike-domain-warning-email-template)),
block it at your mail gateway, and report it to the registrar
([report a lookalike domain](/guides/report-lookalike-domain-takedown)).
Registrars generally act faster when the domain is serving phishing or
sending mail, so collect evidence of use.

## Check your domain

The [lookalike domain checker](/tools/lookalike-domain-checker) tries
single-letter Cyrillic swaps of your domain along with typos and added
words, and shows which are registered and can send email. Nameward's
monitoring also matches newly registered domains, including `xn--` names,
against yours every day.

## Sources

- [RFC 3492: Punycode](https://www.rfc-editor.org/rfc/rfc3492)
- [RFC 5890: IDNA definitions (A-labels, U-labels, xn--)](https://www.rfc-editor.org/rfc/rfc5890)
- [Chromium: IDN display policy](https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md)
- [Mozilla: IDN display algorithm](https://wiki.mozilla.org/IDN_Display_Algorithm)
- [Mozilla bug 1357687: the аррӏе.com demonstration](https://bugzilla.mozilla.org/show_bug.cgi?id=1357687)
- [Unicode UTS #39: security mechanisms (confusables)](https://www.unicode.org/reports/tr39/)
- [ICANN: IDN implementation guidelines](https://www.icann.org/resources/pages/idn-guidelines-2011-09-02-en)
- [Verisign: IDN registration rules](https://www.verisign.com/resources/internationalized-domain-names/idn-registration-rules/)

---
Source: https://nameward.app/guides/punycode-homograph-domains (updated 2026-10-31)