RFC 6912
Principles for Unicode Code Point Inclusion in Labels in the DNS
RFC 6912: Principles for Unicode Code Point Inclusion in Labels in the DNS 💅✨
okay bestie, let's get into it 🫶 this RFC is from the Internet Architecture Board (IAB), published April 2013, and it's Informational (so it's a guidance doc, not a protocol standard, no cap). Its number is RFC 6912, and its ISSN is 2070-1721 🎀. The authors are A. Sullivan (Dyn, Inc.), D. Thaler (Microsoft), J. Klensin, and O. Kolkman (NLnet Labs) 👑. It doesn't say it obsoletes or updates anything, so it doesn't 🌸
Abstract
okay so here's the vibe: IDNA gives DNS zone admins a HUGE range of Unicode code points 🌈 but most zone operators probably shouldn't let registrations use the entire range 💀 this is especially true for zones that take registrations from outside organizations, like top-level domains and, most importantly, the root 👑. The sad part is there's no algorithm that can figure out whether allowing a code point is low risk 😭 so this memo gives a set of principles to help decide whether a Unicode code point is wise to include in the allowed repertoire for a U-label in a zone 🦋
Status of This Memo
this document is not an Internet Standards Track spec, it's published just for information 🧚
it's a product of the Internet Architecture Board (IAB) and it's basically info the IAB decided is worth keeping on record forever 📚 it represents the consensus of the IAB, and docs the IAB approves for publication aren't candidates for any level of Internet Standard. see Section 2 of RFC 5741 for that 💜
for the current status, any errata, and how to give feedback, check http://www.rfc-editor.org/info/rfc6912 🔥
Copyright Notice
Copyright (c) 2013 IETF Trust and the persons identified as the document authors. All rights reserved. 🌸
this document is subject to BCP 78 and the IETF Trust's Legal Provisions Relating to IETF Documents (http://trustee.ietf.org/license-info) as in effect on the date of publication. please read these carefully, because they describe your rights and restrictions for this document 🫶
Table of Contents
1. Introduction . . . . . . . . . . . . . . . . . . . . . . . . 3
1.1. Terminology . . . . . . . . . . . . . . . . . . . . . . . 3
2. Background . . . . . . . . . . . . . . . . . . . . . . . . . 4
2.1. More-Restrictive Rules Going Up the DNS Tree . . . . . . 6
3. Principles Applicable to All Zones . . . . . . . . . . . . . 6
3.1. Longevity Principle . . . . . . . . . . . . . . . . . . . 6
3.2. Least Astonishment Principle . . . . . . . . . . . . . . 6
3.3. Contextual Safety Principle . . . . . . . . . . . . . . . 7
4. Principles Applicable to All Public Zones . . . . . . . . . . 7
4.1. Conservatism Principle . . . . . . . . . . . . . . . . . 7
4.2. Inclusion Principle . . . . . . . . . . . . . . . . . . . 7
4.3. Simplicity Principle . . . . . . . . . . . . . . . . . . 7
4.4. Predictability Principle . . . . . . . . . . . . . . . . 8
4.5. Stability Principle . . . . . . . . . . . . . . . . . . . 8
5. Principle Specific to the Root Zone . . . . . . . . . . . . . 8
5.1. Letter Principle . . . . . . . . . . . . . . . . . . . . 8
6. Confusion and Context . . . . . . . . . . . . . . . . . . . . 9
7. Conclusion . . . . . . . . . . . . . . . . . . . . . . . . . 9
8. Security Considerations . . . . . . . . . . . . . . . . . . . 10
9. Acknowledgements . . . . . . . . . . . . . . . . . . . . . . 10
10. IAB Members at the Time of Approval . . . . . . . . . . . . . 10
11. Informative References . . . . . . . . . . . . . . . . . . . 101. Introduction ✨
okay so zone operators need to set policies about which Unicode code points are allowed in labels in their zone 🍓 there are usually a bunch of big goals to juggle here, like avoiding labels that look visually confusable with each other, avoiding mix-ups between Fully Qualified Domain Names (FQDNs) and IP address literals, making things accessible for disabled users (see "Web Content Accessibility Guidelines (WCAG) 2.0" [WCAG20] for some discussion in a web context) 🦋 and other usability stuff too 🌈
this doc gives zone operators a set of principles to build their code point policies, so things are more usable and clear and there's less confusion overall 💖
1.1. Terminology
this doc uses the following terms 🎀
- A-label: an LDH label that starts with "xn--" and meets all the IDNA requirements, with additional restrictions as explained in Section 2.3.2.1 of the IDNA Definitions document [RFC5890] 💜
- Character: a member of a set of elements used for the organization, control, or representation of data. see Section 2 of the Internationalization Terminology document [RFC6365] for more details 🧚
- Language: a way that humans communicate. the use of language happens in lots of forms, the most common being speech, writing, and signing. see Section 2 of RFC 6365 for more details 🌸
- LDH label: a string made of ASCII letters, digits, and the hyphen, with additional restrictions as explained in Section 2.3.1 of RFC 5890 ✨
- Public zone: in this doc, a DNS zone that accepts registration requests from organizations outside the zone administrator's own organization. (whether the zone does delegation is a separate question 🙈 what matters is how diverse the registration-requesting community is.) note that under this definition, the root zone is a public zone, though it has a unique function in the DNS 👑
- Rendering: the display of a string of text. see Section 5 of RFC 6365 for more details 🦋
- Script: a set of graphic characters used for the written form of one or more languages. see Section 2 of RFC 6365 for more details 🌈
- U-label: a string of Unicode characters that meets all the IDNA requirements and includes at least one non-ASCII character, with additional restrictions as explained in Section 2.3.2.1 of RFC 5890 🔥
- Writing system: a set of rules for using one or more scripts to write a particular language. see Section 2 of RFC 6365 for more details 💅
this memo doesn't propose a protocol standard, and words like "should" get their ordinary English meaning, NOT the meaning laid out in [RFC2119] 🙅♀️ so lowercase "should" here is just regular English, bestie 🫶
2. Background 🌸
okay so in recent communications [IABCOMM1] [IABCOMM2], the IAB really emphasized how important conservatism is when allocating labels that conform to IDNA2008 [RFC5890] [RFC5891] [RFC5892] [RFC5893] [RFC5894] [RFC5895] in DNS zones, especially the root zone 👑 traditional LDH labels in the root zone only used alphabetic characters (ASCII a-z, which under the DNS also match A-Z) 💜 but U-labels are more complicated, ngl 😭 the IAB communications recommended that U-labels permit only code points with a General_Category (gc) of Ll (Lowercase_Letter), Lo (Other_Letter), or Lm (Modifier_Letter), but they noted that for practical reasons other code points might be permitted on a case-by-case basis 🦋
the IAB recommendations do leave some open issues that need to be addressed 🙈 it isn't clear that every code point allowed under IDNA2008 with a General_Category of Lo or Lm is appropriate for a zone like the root zone. take just one example: code point U+02BC (MODIFIER LETTER APOSTROPHE) has a General_Category of Lm. in practically every rendering (and we're not aware of any exception), U+02BC is indistinguishable from U+2019 (RIGHT SINGLE QUOTATION MARK), which has a General_Category of Pf (Final_Punctuation) 💀 a lot of people will also read U+02BC as the same character as U+0027 (APOSTROPHE), which has a General_Category of Po (Other_Punctuation), and some computer systems may treat U+02BC as U+0027 😭 U+02BC is PROTOCOL VALID (PVALID) under IDNA2008 (see the IDNA Code Points document [RFC5892]), whereas both other code points are DISALLOWED 🔥 so, to start with, it's plain that not every code point with a General_Category of Ll, Lo, or Lm is consistent with the type of conservatism principle discussed in Section 4.1 below or the previous IAB recommendations 🎀
it gets messier 🌪️ some languages depend on code points with General_Category Mc (Spacing_Mark) or General_Category Mn (Nonspacing_Mark). this dependency is especially common in Indic languages, though it isn't exclusive to them. (at the risk of vastly oversimplifying, the big issue is mostly how complex writing systems interact with the way Unicode works 🧚) restricting users of those languages to only code points with General_Category Ll, Lo, or Lm would be extremely limiting 😭 DNS labels aren't words, sentences, or phrases (as noted in the next steps for IDN [RFC4690]), but they're meant to support useful mnemonics 💖 mnemonics that wildly diverge from the usual conventions are poor ones, because if they don't follow the usual conventions they're hard to remember 🙈 and wide divergence from usual conventions, if it isn't well-justified (especially in a shared namespace like the root), invites political controversy 💅
a lot of the issues above turn out to be relevant to all public zones 🌈 the bigger question of developing a policy for code point permission is common to every zone that accepts A-labels or U-labels for registration. as Section 4.3 of the IDNA Protocol document [RFC5891] says, every registry at every level of the DNS is "expected to establish policies about label registrations" 🫶
for sound management reasons, it isn't desirable to decide whether to permit a given code point only when an application containing that code point is pending 🙅♀️ that approach reduces predictability and is bound to look like it's subject to special pleas 💀 it's better to produce the rules governing acceptance of code points in advance ✨
as the foregoing discussion about the Letter and Mark categories makes clear, it's simply not possible to make code point decisions algorithmically 😭 if it were possible to build such an algorithm, it would already exist: the DNS is hardly unique in needing to impose restrictions on code points while accommodating many different linguistic communities 🌸 still, new guidelines can be made by starting from overarching principles 👑 these guidelines work more as meta-rules, leading to the creation of other rules about including and excluding particular code points in labels in a given zone, always based on the list of code points permitted by IDNA 🦋💜
2.1. More-Restrictive Rules Going Up the DNS Tree
okay so the next bit is basically the big rulebook 📖✨ it's split into three groups of principles (Sections 3 through 5), and the vibe is that some rules apply to every zone, some only to public zones, and some only to the root zone 🌈. the rule of thumb is that the higher up the DNS tree a zone sits, the stricter its rules get, because more principles stack on top 👑. lower zones are used in a smaller, narrower context, so they get chill rules 🧚. and the context that matters is the zone's, not some slice of the users 💅. for the root zone, the context is "the entire Internet population" 🌸 bestie, that's the whole planet 😭
3. Principles Applicable to All Zones ✨
3.1. Longevity Principle 🦋
Unicode properties of a code point ought to be stable across the versions of Unicode that users of the zone are likely to have installed 💖. the properties of a code point can change between Unicode versions, so a good way to predict stability is to check that the code point has actually stayed the same across multiple successive versions of Unicode 🔥. this ties into the Stability Principle in Section 4.5 🫶
the more diverse the community using a zone, the more this matters 🌸. a leaf zone in the DNS might only need stability across two Unicode versions, but a more public zone might want four or more releases before the code point counts as long-lived and stable 👑 that's giving careful
3.2. Least Astonishment Principle 🎀
every zone administrator should be sensitive to how likely a code point is to be used, especially with the population that's likely to use the zone 💅. admins should specifically think about whether a candidate code point could cause trouble when it shows up outside its normal linguistic circumstances 😭. and the flip side is just as real: not supporting a code point that's totally normal in some language could be super surprising for the people who run into those names 🙈
3.3. Contextual Safety Principle 💀
every zone administrator should be sensitive to ways a code point that's allowed could be used for malicious stuff 🙅♀️. this isn't a brand-new problem, since the digit 1 and the lowercase letter l are easily confused in lots of contexts 👀. Unicode has a huge repertoire of code points (even just the subset allowed for IDNs), and that scale makes the problem somewhat worse 🔥
4. Principles Applicable to All Public Zones 🌈
4.1. Conservatism Principle 🫶
public zones are, by definition, shared by different groups of people 💜. so any decision to permit a code point in a public zone (including the root) should be as conservative as practicable 🍓. when in doubt, reject it rather than include it, to minimize risk 🛡️
4.2. Inclusion Principle 🦋
just like IDNA2008 starts by excluding the Unicode range and then adds code points based on their derived properties, a public zone should only permit a code point if it's known to be "safe" for usability and confusability within that zone's context ✨. the default treatment of a code point is that it's excluded 🚫 nothing gets in without a pass
4.3. Simplicity Principle 🎀
the rules for deciding whether a code point gets included should be simple enough that someone with a moderate background in DNS and Unicode can readily understand them 🧠. this doesn't mean a totally naive person has to get the reasoning, but if the reason for including a very peculiar code point (even a safe one) is too hard to understand, that code point wouldn't be permitted 💅
"simple" and "readily understood" depend on the context 🌸. the root zone has to serve everyone in the world, so the reasons for including a code point need to make sense even to people who can't use that script at all 😭. a zone that only allows a constrained subset of Unicode (like only what's needed for one alphabetic language) and serves a clearly defined linguistic community (like speakers of one language with well-understood writing conventions) might be okay with more complicated rules 🧚. compare this with the Least Astonishment Principle in Section 3.2 💜
4.4. Predictability Principle 🔮
the rules for deciding inclusion should be predictable enough that people with the right understanding of DNS, IDNA, and Unicode will usually land on the same answer 💖. this isn't a demand for an algorithm, since that's not possible 🙅♀️. it means that applying professional judgment consistently should give the same results, and combined with the principle in Section 4.1, if results aren't predictable, the weird code point just wouldn't be permitted 🔥
just like in Section 4.3, this principle means more restriction the more diverse the community is, so it's strictest for the root zone 🌍. that's because what's predictable inside one language community can be really surprising across languages 😭
4.5. Stability Principle 🧊
once a code point is permitted, it's very hard to stop permitting it 🥶. in public zones (including the root), the list of permitted code points should change very slowly, if at all, and usually only to add something, as time and experience show that including it is both safe and consistent with these principles ✨
5. Principle Specific to the Root Zone 👑
5.1. Letter Principle 🔤
"Requirements for Internet Hosts - Application and Support" [RFC1123] notes that top-level labels "will be alphabetic" 💅. without widespread agreement on how strongly that note applies, prudence says U-labels in the root zone should leave out code points that aren't normally used to write words, or that are sometimes used for things other than writing words 🙃. this isn't the same as using Unicode's General_Category to include only letters 🙅♀️. it's a restriction that stretches the allowed set past Unicode letters, but only as far as the things people actually use to build words 🌸. under this principle, code points like General_Category Mn (Nonspacing_Mark) might get included, but only the ones used to write words, not things like musical symbols 🎶. also, marks should only be used within a label the way they'd be used when making a word, so combinations that would be nonsense in a word should be rejected in DNS labels too 💀. this principle should be applied as narrowly as possible, and the next steps for IDN document [RFC4690] puts it perfectly: "While DNS labels may conveniently be used to express words in many circumstances, the goal is not to express words (or sentences or phrases), but to permit the creation of unambiguous labels with good mnemonic value" 🫶
6. Confusion and Context 🕵️♀️
okay so while lots of talk about confusion focuses on characters, like whether two characters can be confused with each other (and when), focusing only on characters could ban a huge number of labels that are basically harmless 😭. so the focus should be on whether one label is confusable with another 💖. for example, if a label has several characters that are unique to one script, and all of its characters come from that script, it's inherently not confusable with a label from any other script, no matter what else is in it ✨. another label that lacks those distinguishing characters might be a problem 👀. this idea also stretches from labels to domain names, since distinguishing characters in a higher-level label can set expectations about the characters in lower-level labels 🌳. that expectation could be a benefit, but it's also a problem, because there's no technical way to require consistent policies across delegated namespaces 🙈
7. Conclusion 🎀
the principles here can be applied when considering any range of Unicode code points for possible inclusion in a DNS zone 💅. it's worth noting that doing anything (especially in light of Section 4.5) implicitly disadvantages communities with a writing system that isn't yet well understood or well represented in the technical and policy communities discussing it 😔. that disadvantage should be guarded against as much as practical, but it's basically impossible to prevent while still taking action, given imperfect human knowledge 🫶
8. Security Considerations 🔐
⚠️ the principles in this memo are meant to improve usability and clarity, and thereby reduce confusion among different labels 💀 they may help reduce risk, but they are not sufficient to provide a comprehensive internationalization policy for zone management 😭
more security discussion can be found in the Unicode Security Considerations [UTR36] 🔍
9. Acknowledgements 💜
the authors thank the participants in the IAB Internationalization program for discussing the ideas in this memo, especially Marc Blanchet 🫶. stephane bortzmeyer, paul hoffman, daniel kalchev, panagiotis papaspiliopoulos, and vaggelis segredakis also made specific comments 🌸
10. IAB Members at the Time of Approval 👑
Bernard Aboba
Jari Arkko
Marc Blanchet
Ross Callon
Alissa Cooper
Spencer Dawkins
Joel Halpern
Russ Housley
David Kessens
Danny McPherson
Jon Peterson
Dave Thaler
Hannes Tschofenig11. Informative References ✨
okay bestie, here's the reading list 📚 these are the docs the spec leans on for the rest of its story, so make sure you have them bookmarked 🔖
[IABCOMM1] Internet Architecture Board, "IAB Statement: 'The
interpretation of rules in the ICANN gTLD Applicant
Guidebook'", February 2012, <http://www.iab.org/
documents/correspondence-reports-documents/201/>.
[IABCOMM2] Internet Architecture Board, "Response to ICANN questions
concerning 'The interpretation of rules in the ICANN gTLD
Applicant Guidebook'", March 2012, <http://www.iab.org/
documents/correspondence-reports-documents/201/>.
[RFC1123] Braden, R., "Requirements for Internet Hosts - Application
and Support", STD 3, RFC 1123, October 1989.
[RFC2119] Bradner, S., "Key words for use in RFCs to Indicate
Requirement Levels", BCP 14, RFC 2119, March 1997.
[RFC4690] Klensin, J., Faltstrom, P., Karp, C., and IAB, "Review and
Recommendations for Internationalized Domain Names
(IDNs)", RFC 4690, September 2006.
[RFC5890] Klensin, J., "Internationalized Domain Names for
Applications (IDNA): Definitions and Document Framework",
RFC 5890, August 2010.
[RFC5891] Klensin, J., "Internationalized Domain Names in
Applications (IDNA): Protocol", RFC 5891, August 2010.
[RFC5892] Faltstrom, P., "The Unicode Code Points and
Internationalized Domain Names for Applications (IDNA)",
RFC 5892, August 2010.
[RFC5893] Alvestrand, H. and C. Karp, "Right-to-Left Scripts for
Internationalized Domain Names for Applications (IDNA)",
RFC 5893, August 2010.
[RFC5894] Klensin, J., "Internationalized Domain Names for
Applications (IDNA): Background, Explanation, and
Rationale", RFC 5894, August 2010.
[RFC5895] Resnick, P. and P. Hoffman, "Mapping Characters for
Internationalized Domain Names in Applications (IDNA)
2008", RFC 5895, September 2010.
[RFC6365] Hoffman, P. and J. Klensin, "Terminology Used in
Internationalization in the IETF", BCP 166, RFC 6365,
September 2011.
[UTR36] Davis, M. and M. Suignard, "Unicode Security
Considerations", Unicode Technical Report #36, July 2012.
[WCAG20] W3C, "Web Content Accessibility Guidelines (WCAG) 2.0",
W3C Recommendation, December 2008,
<http://www.w3.org/TR/2008/REC-WCAG20-20081211/>.Authors' Addresses 💌
the people who wrote this doc, their deets, all in one place 🫶
Andrew Sullivan
Dyn, Inc.
150 Dow St
Manchester, NH 03101
USA
EMail: asullivan@dyn.com
Dave Thaler
Microsoft
One Microsoft Way
Redmond, WA 98052
USA
EMail: dthaler@microsoft.com
John C Klensin
1770 Massachusetts Ave, Ste 322
Cambridge, MA 02140
USA
Phone: +1 617 491 5735
EMail: john-ietf@jck.com
Olaf Kolkman
NLnet Labs
Science Park 400
Amsterdam 1098 XH
The Netherlands
EMail: olaf@NLnetLabs.nl📦 where this page comes from
- ietf: rfc6912 2013-04
- 💖 girlified by claude-haiku-5-5 on : a language model's rewrite of the original, under its terms