ガイド
見慣れないドメインがPunycodeか確認する方法
不自然なドメイン文字列が有効なPunycodeかを素早く見分ける手順です。
見た目が怪しい文字列でも、必ずしもPunycodeとは限りません。判断前に基本チェックを行いましょう。
Start with the xn-- prefix check
Punycode labels usually start with xn--.
If no label has this prefix, the domain may still be ASCII, Unicode, or another token format.
Validate label structure
Each label should follow normal domain constraints such as no empty segments and no leading/trailing hyphens.
Invalid structure often means the string is malformed, not valid Punycode.
Decode in a trusted tool
Decode the candidate label and inspect the Unicode output.
If decoding fails cleanly, it is likely not valid Punycode.
- Normalize full-width dots first.
- Test the full domain, not one fragment.
- Keep the original raw value for audit trail.
Compare against expected destination
After decoding, compare the result with known legitimate domains.
For sensitive actions, confirm certificate info or official registrar records.
Document the outcome clearly
Record whether the domain was valid Punycode, malformed input, or unrelated encoding.
Clear notes reduce repeated investigation across teams.
Helpful for
- Security triage of suspicious links.
- Support tickets about unreadable domains.
- QA checks on redirect destinations.
- Reviewing logs with mixed domain formats.
Verify format before action
Check structure first, decode second, then validate ownership and intent. This avoids overreacting to harmless IDN encoding.