What is not allowed in domain names?

Many business owners assume domain naming rules are the same everywhere — they're not. ICANN coordinates the global DNS, but it delegates technical rule-making to individual registry operators, which means what's allowed in one TLD can be rejected in another.

Take .CA and .eu as case studies in divergence. CIRA permits only ASCII letters, digits, and hyphens (never at the start or end) with a 2–63 character limit. EURid, by contrast, supports Internationalized Domain Names across Latin, Cyrillic, and Greek scripts — but enforces strict script consistency: every character in the second-level domain must come from the same script, and that script must match the TLD extension (.eu for Latin, .ею for Cyrillic, .ευ for Greek). Mixing scripts in a single domain is prohibited. EURid also uses homoglyph bundling — visually confusable domains across scripts are grouped, and only the first requested can be registered — an anti-spoofing measure with no equivalent in ASCII-only zones.

Length limits, prohibited patterns, and legacy bans also differ. EURid revoked domains with hyphens in positions 2–3–4 simultaneously, plus the characters "ŀ" and "ı", effective 6 May 2016 after a one-year grace period. CIRA's validation tool simply rejects anything outside its ASCII ruleset. Meanwhile, sponsored TLDs like .edu and .gov add eligibility restrictions based on entity type, and brand TLDs such as .google are reserved for their owners.

• Character sets: ASCII-only vs. multi-script IDN support
• Script mixing: prohibited in .eu, not applicable in .CA
• Homoglyph protection: active bundling in .eu, absent in ASCII zones
• Length limits: 2–63 chars (.CA), varies by registry
• Legacy bans: specific characters and patterns phased out per registry

This fragmentation means compliant domain selection requires checking the target registry's published policies — not a universal list. AI Business Sites registers domains in the client's name and validates candidates against the specific TLD's rules before submission, so the build launches without registration surprises.

Domain naming rules are not universal — each registry sets its own character whitelist, length limits, and prohibited patterns. What passes in one TLD gets rejected outright in another, and the differences are more specific than most business owners expect.

Canada's registry offers a clear baseline. According to CIRA's official guidance, .CA domain names can only contain letters A through Z and numbers 0 to 9, plus hyphens — as long as the hyphen doesn't appear at the start or end of the name. Names must fall between 2 and 63 characters, and CIRA flags some strings as restricted entirely, meaning they're blocked regardless of character composition.

The European registry takes a more layered approach because it supports Internationalized Domain Names (IDNs). Under EURid's published policy, .eu domains may use Latin, Cyrillic, or Greek scripts alongside digits 0–9 and hyphens — but with strict consistency rules:

• All characters in the second-level domain must come from a single script — mixing Latin and Cyrillic in one name is prohibited.
• The script must match the TLD extension: Latin names use .eu, Cyrillic names use .ею, and Greek names use .ευ.
• Homoglyph bundling blocks visually confusable lookalikes — only the first-requested domain in a matching visual group can be registered.
• Even newly allowed characters like German Sharp S (ß) enter bundles, so registering ß blocks the "ss" equivalent and vice versa.

EURid also maintains a list of revoked patterns that can never be re-registered. As of 6 May 2016 — following a one-year grace period — the registry blocked domains containing hyphens in positions 2, 3, and 4 simultaneously, the "ŀ" character (L with a middle dot not followed by another L), and "ı" (the dotless i). These aren't soft recommendations; they're hard registration rejections at the registry level.

The anti-spoofing logic behind these rules matters for any business. EURid explains that homoglyph bundling exists to prevent "domain names from two different character sets that are visually indistinguishable" — the exact mechanism phishing attackers use to impersonate brands. A name that looks right can still be blocked because a confusable variant already exists.

Beyond characters, eligibility itself can be a restriction. As HostPapa's TLD overview notes, sponsored extensions like .edu and .gov carry strict entity requirements, some country-code TLDs demand local residency, and brand TLDs like .google are closed to the public entirely.

The practical takeaway is that compliant domain selection requires checking the target registry's rules before committing — character sets, hyphen placement, script consistency, homoglyph conflicts, and eligibility all vary by TLD. This is exactly why our setup team at AI Business Sites validates every client's domain choice against the relevant registry's policies during the build process, registering it in the client's name so ownership and compliance are settled from day one.

Some of the most dangerous domain names ever registered aren't offensive — they're nearly invisible copies of legitimate ones. A single swapped character, like a Greek "α" replacing a Latin "a", can fool even careful users into typing credentials into the wrong site.

This is the problem EURid, the registry behind .eu, solves with homoglyph bundling. According to EURid's policy documentation, a homoglyph bundle is a group of domain names of which only the one requested first can be registered. Visually confusable variants across Latin, Cyrillic, and Greek scripts are grouped together, and once one is claimed, every lookalike in that bundle is blocked from registration.

The registry's reasoning is straightforward: bundling "contributes to a safer Internet environment" by preventing domain names built from two different character sets that are visually indistinguishable — the exact recipe for phishing. The bundling applies to .eu (Latin script) and .ευ (Greek), and it interacts with a separate rule: scripts cannot be mixed within a second-level domain, and the script must match the extension.

The IDNA2008 protocol update added a practical wrinkle. Two characters that were previously off-limits became registerable inputs:

• German sharp S (ß) — now allowed, but bundled with "ss", so registering one blocks the other
• Greek ending sigma (ς) — now allowed, but bundled with "σ" under the same first-come, first-served logic
• Same-registrant pairs of bundled domains may temporarily coexist, with consolidation planned over time

Existing domains got grandfathered treatment. EURid's records show that domains registered before the 6 May 2015 policy change kept their status — but there's a catch. If a grandfathered domain is ever deleted, it becomes homoglyph blocked, meaning it cannot be re-registered. Letting an old bundled domain lapse is effectively a one-way door.

For a business owner, none of this should be on your plate. When a setup team like AI Business Sites registers a client's domain, checking the candidate name against the target registry's character rules, script consistency requirements, and bundle conflicts is part of the job — before the registration attempt, not after a rejection. Since rules vary by TLD and no universal prohibited-character list exists, the safest approach is verifying against the specific registry's published policy every time.

Sometimes a domain name is perfectly valid — every character allowed, length in range — and you still can't register it. The reason has nothing to do with what's in the name and everything to do with who is allowed to hold it.

Domain eligibility rules vary by extension, and according to HostPapa's overview of TLD types, nearly 1,600 TLDs are now available for registration, each with its own policies. Three broad categories carry registrant-based restrictions worth knowing before you fall in love with a name.

• Sponsored TLDs — Extensions like .edu, .gov, and .museum are managed by specific organizations that enforce strict eligibility. Only accredited educational institutions can register .edu, only government bodies can hold .gov, and .museum is reserved for verified museums. No amount of money or clever phrasing gets around these gates.
• Country-code TLDs with local presence rules — Some ccTLDs require the registrant to be a resident or legal entity within the country the extension represents, while others are open to anyone globally. The rules differ country by country, so you must check the specific registry's policy before committing.
• Brand TLDs — Extensions like .google and .aws are closed registries reserved for the companies that own them. They were never available for public registration and never will be.

By contrast, the legacy extensions most businesses know — .com and .net — carry no eligibility restrictions at all. Anyone, anywhere, can register one. That openness is part of why .com alone accounts for roughly 159.4 million registrations, per the DNIB Q3 2025 industry report.

Open access comes with a hidden advantage: trust and staying power. The same report shows legacy gTLDs renew at 82.5%, while new gTLDs renew at just 32.2% — a striking gap that suggests many newer-extension registrations are speculative or short-lived. HostPapa also notes that some newer or cheaper gTLDs, such as .xyz or .top, have become associated with spam, which erodes user trust even when the name itself is perfectly legitimate.

For a small business, the practical takeaway is straightforward: unless you qualify for a sponsored extension or specifically need a country code, an unrestricted legacy TLD is usually the safest, most credible choice. And if a restricted extension does fit — say you're a registered charity or museum — expect to provide documentation proving eligibility before the registry approves you.

This is exactly the kind of check a proper setup process handles quietly. When AI Business Sites registers a client's domain in their name, eligibility is verified against the target registry's rules before anything is submitted — so there are no rejected applications, no wasted registration fees, and no surprises after launch. You get a domain you legally qualify for, own outright, and can keep for as long as you run your business.

Registering a domain that violates registry rules doesn't just fail at checkout — it can mean lost time, rebranding costs, or even a revoked domain months later. A thorough setup process prevents all of this by validating every candidate name before a client ever commits to it.

Because ICANN delegates technical rules to individual registry operators, there is no single universal checklist. A compliant process starts with a per-TLD character rule engine that applies the right constraints for each extension. For a .ca domain, that means enforcing CIRA's rules: letters A–Z, digits 0–9, hyphens only away from the start and end, and a length of 2 to 63 characters, per CIRA's published guidance.

For internationalized domain names, the process needs script-consistency checks. EURid prohibits mixing scripts within a .eu domain and requires the second-level script to match the extension — Latin for .eu, Cyrillic for .ею, Greek for .ευ — according to EURid's IDN policy documentation. Validation should catch a Latin-plus-Cyrillic combination at input time, not after submission.

Next comes homoglyph bundle pre-screening. EURid allows only the first-requested domain in a group of visually confusable names to be registered — Latin "a" versus Greek "α", for instance. Screening candidates against these bundles upfront prevents a client from building a brand around a name that can never be theirs.

A complete verification workflow covers six checks:

• Character, length, and hyphen-placement rules for the specific TLD
• Script consistency and script-to-extension matching for IDNs
• Homoglyph bundle conflicts that block lookalike registrations
• Legacy prohibited patterns — EURid revoked names containing hyphens in positions 2–3–4, "ŀ", and "ı" as of 6 May 2016
• TLD eligibility, since sponsored extensions like .edu and .gov, some country codes, and brand TLDs restrict who may register, as TLD eligibility overviews explain
• Restricted or reserved names — CIRA's own tool flags some domains simply as "restricted and can't be registered"

Trademark and reserved-name clearance rounds out the process. Registries maintain restriction lists beyond character rules, and registrants have the right to information from their registrar about registration processes under ICANN's registrant policies — a thorough setup uses that transparency rather than discovering conflicts after launch.

This rigor matters more as the namespace expands. With 378.5 million domains registered across all TLDs as of Q3 2025 and ICANN's next gTLD round expected to open in April 2026, the pool of rules to check keeps growing.

At AI Business Sites, every client's domain is registered in their own name — which is exactly why compliant selection happens before registration, not after. A name that passes every registry check on day one stays yours for the life of the business.