# Punycode phishing: how IDN homograph attacks work and how to catch them

URL: https://iblockspam.com/blog/punycode-idn-homograph-phishing
Last updated: 2026-10-12
Published: 2026-10-12
Topic: Phishing & threats
Author: iBlockSpam Team

> How punycode (xn--) domains spell a brand with lookalike Unicode letters, how browsers react, how to decode a suspect name and how admins can flag them.

## Short answer

An IDN homograph attack registers a domain that uses lookalike letters from another script, such as a Cyrillic 'а' in place of a Latin 'a', so it looks like a real brand. In DNS the name is stored in punycode, starting with xn--. Decode any xn-- name you didn't expect, distrust mixed-script domains and flag them at your filter.

Some phishing domains don't misspell a brand at all. They spell it with letters from a different alphabet that look the same on screen. The trick is called an IDN homograph attack, and its fingerprint is a domain that starts with `xn--`. This guide explains the mechanics, shows how to decode a suspect name, and covers the controls that catch it. For the wider family of typo and cousin domains, see [lookalike domain phishing](https://iblockspam.com/blog/lookalike-domain-phishing); for everyday link checks, see [how to check if a link is safe](https://iblockspam.com/blog/how-to-check-if-a-link-is-safe).

## What is an IDN homograph attack?

An IDN homograph attack uses an internationalized domain name (IDN), a domain containing non-ASCII characters, whose letters look like the letters of a real domain. A homograph is a word that looks the same as another; a homoglyph is a single character that looks like another, such as Latin `a` (U+0061) and Cyrillic `а` (U+0430).

The Chromium project's [IDN documentation](https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md) puts the problem simply: "the Latin 'a' looks a lot like the Cyrillic 'а'," so someone could register a name that is visually identical to a famous one. The Unicode Consortium's [UTS #39](https://www.unicode.org/reports/tr39/) uses "paypal" spelled with a Cyrillic letter as its own example.

## How does punycode work?

Punycode is the encoding that turns a Unicode domain label into plain ASCII so DNS can store it. [RFC 3492](https://www.rfc-editor.org/rfc/rfc3492.html) defines it as "a simple and efficient transfer encoding syntax" that "uniquely and reversibly transforms a Unicode string into an ASCII string." The IDNA standards then add a prefix: [RFC 5890](https://www.rfc-editor.org/rfc/rfc5890.html) says "xn--" "appears at the beginning of every A-label."

Two terms help:

- **U-label:** the Unicode form people read, such as `bücher`.
- **A-label:** the ASCII form stored in DNS, such as `xn--bcher-kva`.

Here's how real and lookalike names encode. The lookalike rows are illustrative examples on reserved or fictional names.

| What you see | Characters used | Stored in DNS as | Legitimate? |
|---|---|---|---|
| `bücher.example` | Latin with ü | `xn--bcher-kva.example` | Normal German IDN |
| `exаmple.com` | Latin plus one Cyrillic `а` | `xn--exmple-4nf.com` | Mixed-script homograph |
| `micrоsoft.example` | Latin plus one Cyrillic `о` | `xn--micrsoft-qbh.example` | Mixed-script homograph |
| `ехаmрle.com` | Cyrillic `е х а р` plus Latin `m l` | `xn--mle-5cdy2e6a.com` | Mixed-script homograph |
| `example.com` | ASCII only | `example.com` | The real one |

Notice what punycode does to the lookalike: the ASCII letters stay in order and the foreign characters move into a coded tail after the last hyphen. So `xn--exmple-4nf` reads as "exmple" plus something hidden, a quick clue that a character was swapped.

### Mixed-script and whole-script lookalikes

UTS #39 (version 18.0.0 at the time of writing) separates two cases:

- **Mixed-script confusables:** a name that combines scripts, such as Latin plus one Cyrillic letter. Most homograph phishing looks like this.
- **Whole-script confusables:** a name written entirely in one other script whose letters happen to resemble a Latin word. Cyrillic has enough Latin lookalikes (`а`, `е`, `о`, `р`, `с`, `х`, `у`) to spell some words completely.

UTS #39 also defines a "skeleton" operation that maps confusable characters to a common form. Detection tools compare skeletons to decide whether a new domain imitates a protected one.

## How do browsers decide whether to show punycode?

Browsers show the readable Unicode form for most IDNs but fall back to the `xn--` form when a name looks risky. Chrome decides separately for each label. According to the [Chromium IDN policy](https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md), it shows punycode when a label, among other checks:

- mixes scripts in ways the UTS #39 "Highly Restrictive" profile forbids; Latin, Cyrillic and Greek can't be mixed with each other;
- matches UTS #39 mixed-script confusable patterns;
- is whole-script confusable and its top-level domain doesn't normally use that script, for example an all-Cyrillic label under `.com`;
- has a skeleton that matches a top domain once accents are removed, for example `googlé` against `google`;
- contains invisible characters, mixed digit systems or digit lookalikes.

The same page says Firefox uses "a similar strategy." These rules make the address bar much safer than it was. They don't help with what happens before you reach the browser.

## Where do homograph domains show up in email?

Homograph domains show up in email in three places: the links in the message body, the sender's address, and the visible link text. Each needs a different check.

- **Links in the body.** The HTML can show any text while pointing to an `xn--` address. Your mail app's link preview may show the Unicode form, not the punycode, because it doesn't necessarily apply browser display rules.
- **The From address.** Domains in addresses can be carried as A-labels, and [RFC 6531](https://www.rfc-editor.org/rfc/rfc6531.html) lets compatible servers carry UTF-8 addresses directly. Either way, a mail app may display the lookalike form.
- **The display name.** Attackers often pair a homograph domain with a trusted display name, as in [display name spoofing](https://iblockspam.com/blog/display-name-spoofing).

Authentication doesn't help here. The attacker owns the homograph domain and can publish SPF, DKIM and DMARC for it, so the mail passes. The [DMARC Checker](https://iblockspam.com/tools/dmarc-checker) will happily show a valid policy on a lookalike.

## How do you check a suspicious domain?

Check a suspicious domain by getting its ASCII form and decoding it, without visiting it. Use this procedure:

1. **Copy the address, don't open it.** Right-click the link and copy it, or copy the sender address from the message details.
2. **Look for `xn--`.** If the copied text shows `xn--`, the name contains non-ASCII characters.
3. **Decode it.** Admins can run `python3 -c "print(b'xn--exmple-4nf.com'.decode('idna'))"` to see the Unicode form. Python's built-in codec follows the older IDNA 2003 rules, which is fine for spotting lookalikes.
4. **Encode the reverse way if you only see Unicode.** Run `python3 -c "print('exаmple.com'.encode('idna'))"` with the pasted name. If the output starts with `xn--` but the name looked like plain English, it contains a lookalike character.
5. **Compare with the real domain** from your contacts, a previous genuine email, or the company's site typed by hand.
6. **Check the headers** with the [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer) to see the real From domain and which domain passed DKIM.
7. **Check whether it's set up for mail** with the [MX Lookup](https://iblockspam.com/tools/mx-lookup). A lookalike with mail servers is being prepared to send or receive.

If the name is a lookalike, report the message and block the domain at your filter.

## Is it safe to click a link with xn-- in it?

Don't click an `xn--` link in an email unless you expected a non-English domain from that sender. Punycode itself isn't dangerous: every internationalized domain uses it, and businesses that write in German, Russian, Greek, Chinese or Arabic may send genuine `xn--` links every day. The risk is the combination of an unexpected `xn--` name and a brand you know in the Latin alphabet. If a decoded name looks like your bank, a software vendor or a supplier, go to that organization's site by typing its address instead.

## How can admins flag punycode domains in email?

Admins can flag punycode domains by adding a rule that matches `xn--` in sender addresses or links, and by monitoring for lookalikes of their own domain. Start by tagging rather than blocking, because legitimate IDN senders exist, especially if you work with partners in other languages.

### Microsoft 365

Exchange Online mail flow rules include **The sender address matches** (`FromAddressMatchesPatterns`), which matches "text patterns that match the specified regular expressions", and **A message header matches** for header fields ([Microsoft Learn](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/conditions-and-exceptions)). A pattern such as `@(.+\.)?xn--` matches sender domains with a punycode label. Pair it with an action such as prepending a warning to the subject, and send yourself a test from a known IDN before relying on it. The rule only sees an `xn--` form if the address arrives that way; a sender address carried in Unicode (UTF-8) won't match, so treat the rule as a partial net.

### Google Workspace and gateways

In Google Workspace, a content compliance rule can match an advanced content pattern against message headers or the body; our [content compliance guide](https://iblockspam.com/blog/google-workspace-content-compliance-rules) shows the steps. At a filtering gateway, add the same pattern to its custom rules, or block specific lookalike domains on your [organization-wide block list](https://iblockspam.com/features/allow-block-lists).

### Watch for homographs of your own domain

Attackers also register homographs of *your* domain to fool your customers and staff. You can't register every variant, and [RFC 5891](https://www.rfc-editor.org/rfc/rfc5891.html) leaves character restrictions to each registry: "Registries at all levels of the DNS, not just the top level, are expected to establish policies about label registrations." Policies vary, so monitoring matters. iBlockSpam's [Lookalike Domain Watch](https://iblockspam.com/features/lookalike-domain-watch) checks daily for typo and homoglyph versions of your domain through DNS and public certificate logs, and alerts you when one is registered or gets a mail server. It detects them; it can't take them down.

## Next steps

- Teach staff one rule: a link or sender that shows `xn--` and resembles a familiar brand is hostile until proven otherwise.
- Add a tagging rule for `xn--` sender domains, test it, and review what it catches for a month before deciding whether to quarantine.
- Run your own domain through a lookalike check and note which homographs already exist.
- If a homograph of a supplier's domain targets you, tell the supplier; see [business email compromise prevention](https://iblockspam.com/blog/business-email-compromise-prevention) for the payment-check rules that stop the follow-up.

Browse our other [phishing and threat guides](https://iblockspam.com/blog/topic/threats).

## Frequently asked questions

### How do I convert an xn-- domain back to readable text?

Use an IDN or punycode converter, or ask IT. On a computer with Python, the command python3 -c "print(b'xn--exmple-4nf.com'.decode('idna'))" prints the Unicode form. Then compare it with the real brand letter by letter. If the decoded name looks like a famous brand, the xn-- form is the giveaway that it uses different characters.

### Are all xn-- domains malicious?

No. Punycode is how every internationalized domain is stored, so legitimate names in German, Russian, Chinese, Arabic and many other languages use it. A domain like bücher.example becomes xn--bcher-kva.example. The warning sign is an xn-- name that decodes to something resembling a Latin-alphabet brand you know.

### Can a homograph domain pass SPF, DKIM and DMARC?

Yes. A homograph domain is a separate domain owned by the attacker, so they can publish SPF, DKIM and DMARC records for it and their mail passes. DMARC protects only the exact domain that publishes the policy. Detecting homographs needs lookalike checks, not authentication.

### Does Chrome protect me from homograph domains?

Partly. Chrome checks each part of a host name and shows the xn-- form instead of Unicode when it mixes scripts such as Latin and Cyrillic, looks confusable with a top domain, or fails other checks. That protects the address bar. It doesn't protect link text inside an email, which your mail app displays however it chooses.

### What is punycode in an email address?

When a domain in an email address contains non-ASCII characters, mail systems can carry it in its ASCII xn-- form. RFC 6531 also lets compatible mail servers carry UTF-8 addresses directly. Either way, a sender domain that decodes to a lookalike of a brand you deal with is a strong phishing signal.

## Sources

- [RFC 3492: Punycode](https://www.rfc-editor.org/rfc/rfc3492.html)
- [RFC 5890: IDNA Definitions and Document Framework](https://www.rfc-editor.org/rfc/rfc5890.html)
- [RFC 5891: IDNA Protocol (section 4.3, registry restrictions)](https://www.rfc-editor.org/rfc/rfc5891.html)
- [Unicode Technical Standard #39: Unicode Security Mechanisms](https://www.unicode.org/reports/tr39/)
- [Chromium: Internationalized Domain Names (IDN) in Google Chrome](https://chromium.googlesource.com/chromium/src/+/main/docs/idn.md)
- [RFC 6531: SMTP Extension for Internationalized Email](https://www.rfc-editor.org/rfc/rfc6531.html)
- [Microsoft Learn: Mail flow rule conditions and exceptions in Exchange Online](https://learn.microsoft.com/en-us/exchange/security-and-compliance/mail-flow-rules/conditions-and-exceptions)

## Free tools for this guide

- [Email Header Analyzer](https://iblockspam.com/tools/email-header-analyzer): Trace hops and authentication results — runs entirely in your browser.
- [MX Lookup](https://iblockspam.com/tools/mx-lookup): See where your mail is delivered, spot unfiltered backup MX and broken hosts.
- [DMARC Checker](https://iblockspam.com/tools/dmarc-checker): Check your policy, reporting and the safe path from p=none to reject.

---

Source: iBlockSpam, https://iblockspam.com/blog/punycode-idn-homograph-phishing (this is a Markdown copy; the HTML page is canonical). Quote with attribution and a link. Site index for AI assistants: https://iblockspam.com/llms.txt