What Characters Are Allowed in a Domain Name?
Letters, digits and hyphens, and that is the entire ASCII list. Then there are emoji domains, Cyrillic lookalikes and the encoding that makes accented names possible. Here are the real rules, and the trap hiding inside them.
September 9, 20265 min readIDN · Punycode · Domain rules
The short answer. A classic domain label may contain letters a to z, digits 0 to 9, and hyphens. Nothing else. It cannot start or end with a hyphen, and it maxes out at 63 characters. Everything beyond that, accents, Chinese characters, emoji, is an encoding trick layered on top.
Most naming advice never mentions these rules, which is how people end up attached to a candidate that cannot be registered. They are worth five minutes.
The classic rules
| Rule | Detail |
|---|---|
| Allowed characters | a-z, 0-9, and the hyphen |
| Case | Irrelevant, domains are case-insensitive |
| Cannot start or end with | A hyphen |
| Maximum label length | 63 characters |
| Maximum full name length | 253 characters |
| Minimum length | 1 character, though most registries set a higher floor |
| Not allowed | Spaces, underscores, and every other punctuation mark |
The character set has a name, LDH, for letters, digits and hyphen.
The underscore surprise. Underscores are not valid in hostnames, but you will see them in DNS records like
_dmarc.yourdomain.com. Those are service records, not hostnames, and different rules apply. You cannot register a domain with an underscore in it.
Why 63?
It is not arbitrary. DNS stores each label with a single length byte, and the two high bits are reserved for message compression. That leaves six bits, giving a maximum of 63. A rule from the 1980s still shapes every name registered today.
Rules registries add on top
The protocol permits more than any registry will actually sell you.
- Two-character minimum at most registries, and single characters are almost universally reserved. This is why
x.comis remarkable: it predates the restriction. - No hyphens in the third and fourth position. A label like
ab--cdis refused, becausexn--needs to stay unambiguous. More on that below. - Premium tiers. Short and dictionary names are often priced far above standard, at the registry level, so every registrar quotes the same high price.
- Eligibility rules on many country extensions, requiring local residence or a registered business.
Internationalized domain names
DNS only understands ASCII. So how does münchen.de work?
Through an encoding called Punycode, which converts Unicode into the limited ASCII set DNS can carry. Every encoded label is prefixed with xn--.
| What you type | What DNS sees |
|---|---|
| münchen.de | xn--mnchen-3ya.de |
| 例え.jp | xn--r8jz45g.jp |
| café.fr | xn--caf-dma.fr |
Your browser does the translation in both directions, which is why you normally never see it. An internationalized domain name is not a different kind of domain. It is an ordinary ASCII domain wearing a costume your browser knows how to remove.
What this means practically
They work everywhere modern. Browsers, and mail servers that support the relevant standards.
They break in older tooling. Legacy systems, some analytics platforms and various command-line tools will show you xn--mnchen-3ya.de and nothing friendlier.
Email is the weak spot. An address at an internationalized domain is accepted far less consistently than a web address at the same domain. If mail matters, test with the providers your customers actually use before committing.
Emoji domains
Yes, they exist. No, you probably cannot have one.
A handful of country extensions permit emoji, but the major generic extensions including .com do not, and ICANN guidance discourages them because emoji render differently across platforms, which makes them ambiguous by design.
Treat emoji domains as a novelty and a redirect, never as a primary address. A name nobody can reliably type or dictate is not an address.
The homograph attack
This is the part worth understanding even if you never register an internationalized name.
The Cyrillic character а (U+0430) and the Latin character a (U+0061) are different characters that render almost identically in most fonts. So an attacker can register a domain that looks exactly like apple.com while being an entirely different name in the DNS.
The technique was first described by Gabrilovich and Gontmakher in 2002 and has been used in real phishing campaigns ever since.
What defends against it
Registry script rules. Most registries prohibit mixing scripts within one label, so you cannot combine Latin and Cyrillic characters in the same name. Each extension publishes the character repertoire it allows.
Browser display policies. Chrome, Firefox and Edge all fall back to showing the raw xn-- form when a name looks suspicious, typically when scripts are mixed or when the characters do not match the user's languages.
The defence is not uniform. There is no single shared browser policy, and punycode phishing has been resurgent, spreading beyond the web into source code and package registries. Seeing
xn--in an address bar where you expected a familiar brand is a signal worth taking seriously.
Should you register an internationalized name?
Yes, if your market genuinely reads a non-Latin script and expects to see it. A Chinese, Russian or Arabic brand looks provincial forced into ASCII.
Yes, defensively. If your brand has an accented spelling, holding both prevents someone else building a convincing lookalike.
No, as your primary address, if your audience is international, you rely heavily on email, or your name must survive being read aloud, printed and retyped. ASCII travels better.
The usual sensible answer is to register the internationalized version and redirect it to an ASCII primary.
The practical checklist
Before you commit to a name:
- Letters, digits, hyphens only. Anything else needs encoding.
- Skip hyphens entirely if you can. They fail the phone test, and a name you cannot dictate costs you traffic every day.
- Avoid digits that sound like words. "4" and "for" is a support burden forever.
- Say it out loud to someone and have them type it. If they get it wrong, so will your customers.
- Check the registry's own rules for the extension, especially on country extensions with eligibility requirements.
- Check availability across extensions at once, rather than falling in love with one before knowing the price.
Run your candidates through the checker to see availability and the real renewal price side by side, or if you have a concept but not a word, the generator works in eight languages and only returns names that are actually registrable.
In one line
The rules are narrow, older than the web, and mostly invisible until you hit one. Learn them before you fall in love with a name, not after.
Put the research to work.
Check your shortlist across the extensions that matter, then save the strongest names to a project.
Check a domain