SimpleWebUtils
ENKO

Document Workflow

Convert an international domain to Punycode for DNS checks

Separate a hostname from its URL, convert Unicode labels to validated ASCII, inspect each label, and compare the result with DNS and application configuration.

Written and tested by Published: Reviewed:

How this workflow was checked

Using IDN Converter for Unicode and Punycode Domains, we reproduced “Map a Japanese separator and keep the root dot” from the exact sample input. The result comparison covered “Keep an untouched comparison value” and “Convert with strict IDNA checks”; the linked test evidence was then checked for “Comparing only the displayed Unicode” and “Assuming conversion means the name is registrable”.

The Japanese full-width separator normalized correctly, both international labels became portal.xn--r8jz45g.xn--zckzah.example., and the trailing root dot survived the round trip.

Open IDN Converter for Unicode and Punycode Domains

Problem

Browsers can display a Unicode hostname while DNS records, certificates, allowlists, logs, and hosting panels use its ASCII Compatible Encoding. Copying an entire URL into a Punycode encoder, comparing only the visual spelling, or assuming a successful conversion proves registration and safety can produce the wrong hostname or hide a mixed-script label.

Sources and standards

These authoritative references define the formats or security boundaries used in this workflow. Tool-specific verification is documented separately above.

When to use this

  • A Unicode hostname and an xn-- hostname appear to describe the same site but do not compare as text.
  • A DNS or hosting provider accepts only ASCII labels for an internationalized domain.
  • A redirect, certificate, allowlist, cookie domain, or application log contains Punycode that needs review.
  • A hostname contains non-Latin characters or several writing scripts and requires label-by-label inspection.
  • A fully qualified domain name ends in a root dot and that exact form must be preserved in a configuration check.

Steps

  1. Step 1

    Extract only the hostname

    Separate the host from `https://`, credentials, a port, path, query, and fragment. Use `URL Parser` first if the source is a full URL. IDNA converts domain labels, not the rest of a URL or the local part of an email address.

  2. Step 2

    Keep an untouched comparison value

    Record the exact hostname shown by the browser, log, certificate, or provider before editing it. Preserve whether it ends in a root dot and do not replace similar-looking characters by eye.

  3. Step 3

    Convert with strict IDNA checks

    Choose `To ASCII (Punycode)` for Unicode input or `To Unicode` for an ASCII or xn-- domain. The IDN Converter applies nontransitional UTS #46 checks, maps recognized Unicode dot separators, and rejects empty labels, invalid Punycode, whitespace, URL delimiters, and DNS length violations.

  4. Step 4

    Inspect every label

    Compare the Unicode and ASCII value of each label. Review any mixed-script warning manually. A warning is useful evidence, but absence of a warning does not prove that a domain is legitimate or immune to visual confusion.

  5. Step 5

    Compare the ASCII form at DNS boundaries

    Use the exact ASCII output when comparing DNS records, certificate names, allowlists, redirects, cookie Domain attributes, hosting settings, and logs. Keep a final root dot only where the target syntax accepts or requires a fully qualified name.

  6. Step 6

    Verify the real service separately

    Check registry policy and availability with the intended registrar, then verify DNS resolution, TLS coverage, HTTP redirects, cookie behavior, and email support in the target environment. Local conversion does not perform any of those network or policy checks.

Example

Map a Japanese separator and keep the root dot

Input

portal.例え。テスト.example.

Output

portal.xn--r8jz45g.xn--zckzah.example.

Common mistakes

Encoding the complete URL

Punycode belongs to hostname labels. Parse the URL first so slashes, a port, query values, and fragments are not mistaken for domain text.

Comparing only the displayed Unicode

Two labels can look similar while using different code points or scripts. Compare the validated ASCII labels for an exact DNS-facing identity check.

Assuming conversion means the name is registrable

Registries can restrict scripts, variants, emoji, reserved names, and label combinations beyond UTS #46. Availability and policy require a separate authoritative check.

Treating script detection as a security scanner

The converter reports common scripts and simple per-label mixing. It does not evaluate the full Unicode confusables data, domain reputation, ownership, page content, or user intent.

Dropping or adding a root dot without context

A final dot represents the DNS root in a fully qualified name. Some configuration formats accept it and others expect the ordinary hostname, so preserve it only when the target context calls for it.

FAQ

Why does the ASCII domain start with xn--?

That prefix marks an ASCII Compatible Encoding label produced for an internationalized domain. Only labels requiring IDNA encoding receive the prefix; plain ASCII labels remain unchanged.

Can I paste https:// and a path into the converter?

No. Extract the hostname first. Rejecting URL syntax prevents a domain converter from silently altering unrelated components such as a path, port, query, or user information.

Why did a Unicode dot become a period?

UTS #46 recognizes several dot-like separators used in international text. The converter maps ideographic, fullwidth, and halfwidth variants to the ASCII period before validating labels.

Does a stable round trip prove that DNS resolves?

No. It proves that the validated Unicode and ASCII representations convert consistently under this profile. DNS resolution requires a separate live lookup.

Can I use the output to validate an international email address?

Only the domain portion is within IDNA's scope. The mailbox local part, SMTPUTF8 support, provider policy, and actual delivery require email-specific validation.

Is input sent to a domain registry?

No. Conversion runs in the browser and does not query DNS, WHOIS, registrars, registries, certificate services, or reputation services.