Special characters and IDN

Module 2: Choosing a good name · Reading time: 8 minutes

Learning objective: After this lesson you can explain how domain names with accents and umlauts work, read a punycode name, and decide when you are better off not using such a name.

Key concepts: IDN, punycode, xn--, IDNA2008, permitted characters per extension, email and IDN, homograph attack

Names with accents exist

The DNS was originally built for the letters a to z, the digits and the hyphen. Yet you see domain names with letters such as é, ü or ß. Names like these are called IDNs: internationalized domain names. They let you write a name the way it is spelled in your own language, for example with a German umlaut or a French accent.

The DNS course briefly mentions IDNs in lesson 1.2. Here you look at them as someone choosing a name: is it possible with your extension, what does such a name look like behind the scenes, and is it a good idea?

Behind the scenes: punycode

The DNS itself still only knows a to z, digits and the hyphen. A name with special characters is therefore converted into a string of ordinary characters with xn-- in front. This conversion is called punycode.

It works per label, so per part between two dots. Only the label with special characters is converted; the extension stays as it is. An example from DNS Belgium: belgië.be becomes xn--belgi-rsa.be in the DNS. And a German bakery called bäckerei.example is known in the DNS as xn--bckerei-5wa.example.

You can see the pattern:

• At the front is xn--. This signals that a converted name follows.
• Next come the ordinary letters of the name, without the special characters: belgi, bckerei.
• After the last hyphen comes a short code that records which special character belongs in which position.

You don't need to work out that code yourself. Browsers, email programs and registrars do it for you. Want to check it? Use a punycode converter: it converts a name with accents into the xn-- form, and the other way round. If you type an xn-- name into your browser, you will often see the name with the special characters in the address bar.

The rules for this are set out in IDNA2008, a set of internet standards (RFC 5890 to 5894). Punycode itself is described in RFC 3492. These rules also lead to something you notice with ordinary names: two hyphens in the third and fourth position of a label are reserved for converted names. So if you see a name with two hyphens in that position, it is not an ordinary name. A registry such as DENIC therefore does not accept such names as an ordinary registration.

Which extensions allow which characters

Whether you can register an IDN depends on the extension. Each registry decides for itself which characters are allowed.

For other extensions, check with the registry or ask your registrar. If Bakkerij Example wants to use its name "Café Example" as a domain name, it cannot do so with an é under .nl: it becomes cafe without the accent.

Why you should be careful with them

An IDN sounds attractive: the name appears exactly as you write it. In practice there are drawbacks.

• Typing. Many people don't have an é or ü on their keyboard, or don't know how to type one. They then type the name without the accent and end up somewhere else.
• Passing it on. On the phone you have to add: "with a u with two dots". That often goes wrong.
• Email. An email address on an IDN doesn't work equally well everywhere. Not every web form and not every email program accepts special characters in an address. Your customer then gets an error message or enters the address differently.
• Display. Some programs show the xn-- form instead of the name with accents. Then something unreadable appears where your customer expects your name.

The advice is therefore: use a name without special characters as your main name, including for your email. If your name has an umlaut or accent, register both forms and redirect the IDN form to the ordinary form. For a ü, you can also consider the form with ue, as Germans are used to.

The homograph attack

IDNs also have a dark side. Some letters from other scripts look exactly like Latin letters. A Cyrillic а looks the same as an ordinary a, but to a computer it is a different character. Criminals use this to create a fake name that looks identical on screen to a real name. This is called a homograph attack.

If you click a link with such a name, you think you are on the site of your bank or your supplier, while you are actually with a fraudster. Browsers therefore sometimes show such a name in the xn-- form, so you can see something is wrong. If you unexpectedly see an xn-- name in your address bar for a site you know, be on your guard.

For your own name this means: you cannot stop someone from registering such a lookalike name, but you can keep an eye on what happens around your name (lesson 7.2).

Summary

• An IDN is a domain name with special characters; in the DNS it is stored as punycode with xn-- in front.
• Only the label with special characters is converted; the extension stays as it is.
• .nl does not allow special characters, .de and .be do (a fixed list).
• IDNs are awkward to type, to pass on and to use as an email address: choose an ordinary name as your main name.
• In a homograph attack, letters from another script look like ordinary letters; an unexpected xn-- name is a warning sign.

Quiz

Exercise

Exercise A2.4: Reading punycode (case study). A colleague at Bakkerij Example has three questions about names with special characters. Use a punycode converter or the explanation in this lesson. Fill in the full name, including the extension.

1. Punycode of café.example. Input field: write the name as it appears in the DNS.
2. Name with special characters for xn--bcher-kva.example. Input field: write the name as a visitor reads it.
3. Is ab--cd.example allowed as an ordinary name (not an IDN)? Choice: yes or no.

The program compares your answers with a fixed key. All three correct means green.

Further reading

• Free DNS course 1.2: How a domain name is structured
• How do I choose my ideal domain name?
• WebOké manual 2.1: Finding and choosing a domain name