The eggplant in the address bar: what an emoji subdomain taught me about the modern web Source

August 28, 2026 Markdown source

1---
2title: "The eggplant in the address bar: what an emoji subdomain taught me about the modern web"
3date: "2026-08-28"
4published: true
5tags: ["emoji", "dns", "idn", "security", "usability", "web"]
6author: "Gavin Jackson"
7excerpt: "My friend Rob registered 🍆.prawnburrito.com, pointed it at my blog, and gave me a reason to look at how emoji domains work, where they break, and why the standards bodies quietly wish people would stop."
8---
9
10# The eggplant in the address bar: what an emoji subdomain taught me about the modern web
11
12A few weeks ago my friend Rob told me he had registered a domain on my behalf.
13
14It was 🍆.prawnburrito.com.
15
16![Eggplant emoji hero](/assets/emoji-urls/eggplant-hero.png)
17
18Rob is a smart arse. He knows I write about infrastructure and the web, and he knows the eggplant emoji will make me sigh in a group chat. But once I stopped rolling my eyes, I realised it was a decent excuse to look at how emoji URLs actually work - and where they start to fall apart.
19
20## What Rob actually registered
21
22`prawnburrito.com` is an ordinary `.com`. Under ICANN's IDNA 2008 rules, the second level of a generic TLD cannot contain emoji. The rules are laid out in RFC 5892, and ICANN's Security and Stability Advisory Committee has been warning about emoji in domain names since at least SAC095. So you cannot register something like `🍆.com` through a normal registrar.
23
24What you *can* do is add an emoji to a subdomain if your DNS host lets you. Rob controls `prawnburrito.com`, so he created a DNS record for `🍆.prawnburrito.com`. The public name resolves as Punycode - `xn--gi8h.prawnburrito.com` - and currently points to Cloudflare's edge, where it serves my own blog, gavinj.net. I do not know whether that is a redirect, a CNAME, or just Rob poking me in the ribs from a thousand kilometres away.
25
26Either way, it is real: type `🍆.prawnburrito.com` into a browser that understands it and you end up on a page with my name in the title.
27
28## How emoji domains work, briefly
29
30The Domain Name System only speaks ASCII. To get Unicode characters into DNS, the Internationalized Domain Name system encodes them with Punycode. Any non-ASCII label is translated into an `xn--` form before it is queried.
31
32For example:
33
34| What a human sees | What DNS sees |
35|---|---|
36| `🍆` | `xn--gi8h` |
37
38The browser does the translation in the background. If it accepts the label, you see the emoji. If it does not, you see the Punycode, or nothing at all.
39
40There is a small list of symbols that work without Punycode - the trademark, information and circled-M emojis - but almost every other emoji has to go through this conversion. That is why `🍆.prawnburrito.com` is really `xn--gi8h.prawnburrito.com` under the hood.
41
42## The security side: spoofing and trust
43
44The obvious risk with any IDN is a homograph attack. A Cyrillic `a` looks identical to a Latin `a`, so `apple.com` and `аpple.com` can render the same way even though they point to different places. Browsers have spent years tightening which scripts can appear together in a single label to stop this.
45
46Emoji raise the same trust problem in a louder, sillier package. A link that says `🍆.legitbank.com` in one app might expand to `xn--gi8h.legitbank.com` in another. Most users have no idea the two are the same address. Worse, some email clients and messaging apps will not hyperlink an emoji URL at all, so an attacker can hide the real destination behind pasted text that *looks* clickable.
47
48It is not that emoji domains are inherently malicious. The issue is that they add a layer of indirection between what people read and what the machine resolves. Anything that widens that gap is useful to phishers.
49
50ICANN's position is essentially: emoji do not belong in the stable, globally consistent part of the DNS hierarchy. That is why they are barred from new gTLDs and from the second level of `.com`. Subdomains are the wild west, which is how Rob got away with it.
51
52## The usability side: emoji was not made for typing
53
54Even if you trust the domain, getting to it is harder than it looks.
55
56- **Typing.** On a phone you can long-press the globe key and hunt for the eggplant. On a desktop you need an emoji picker, a compose sequence, or a copied character. It is faster to type `xn--gi8h.prawnburrito.com`, which rather defeats the point.
57- **Copy and paste.** Behaviour varies between operating systems, browsers, and apps. Some paste the emoji. Some paste the Punycode. Some paste nothing useful at all.
58- **Email.** Many mail clients will not auto-link an emoji URL. Recipients have to copy it manually, at which point the visual pun is more trouble than it is worth.
59- **Certificates.** A TLS certificate issued for `prawnburrito.com` will cover `🍆.prawnburrito.com` if it is a wildcard. A certificate issued for the Punycode label alone is valid too. The mismatch between what users see and what is cryptographically bound to the name is another small source of friction.
60
61In short, emoji URLs work best when the URL is shown to you by someone else: a QR code, a poster, a social post, or a prank. They are not practical for anything you expect people to type from memory.
62
63## What I took away from it
64
65Rob's subdomain is harmless. It is a joke that happens to sit on a real DNS record, and it is a neat demonstration that the internet will let you do things the standards bodies quietly wish you would not.
66
67But the exercise also shows why the standards bodies said no. Emoji in domain names create a gap between appearance and identity. They make URLs harder to type, harder to verify, and easier to misuse. For a marketing campaign with a controlled audience they might be fun. For everyday navigation or security-critical links they are a bad idea dressed up as a cute one.
68
69And yes - Rob is still a smart arse.
70

---
title: "The eggplant in the address bar: what an emoji subdomain taught me about the modern web"
date: "2026-08-28"
published: true
tags: ["emoji", "dns", "idn", "security", "usability", "web"]
author: "Gavin Jackson"
excerpt: "My friend Rob registered 🍆.prawnburrito.com, pointed it at my blog, and gave me a reason to look at how emoji domains work, where they break, and why the standards bodies quietly wish people would stop."
---

# The eggplant in the address bar: what an emoji subdomain taught me about the modern web

A few weeks ago my friend Rob told me he had registered a domain on my behalf.

It was 🍆.prawnburrito.com.

![Eggplant emoji hero](/assets/emoji-urls/eggplant-hero.png)

Rob is a smart arse. He knows I write about infrastructure and the web, and he knows the eggplant emoji will make me sigh in a group chat. But once I stopped rolling my eyes, I realised it was a decent excuse to look at how emoji URLs actually work - and where they start to fall apart.

## What Rob actually registered

`prawnburrito.com` is an ordinary `.com`. Under ICANN's IDNA 2008 rules, the second level of a generic TLD cannot contain emoji. The rules are laid out in RFC 5892, and ICANN's Security and Stability Advisory Committee has been warning about emoji in domain names since at least SAC095. So you cannot register something like `🍆.com` through a normal registrar.

What you *can* do is add an emoji to a subdomain if your DNS host lets you. Rob controls `prawnburrito.com`, so he created a DNS record for `🍆.prawnburrito.com`. The public name resolves as Punycode - `xn--gi8h.prawnburrito.com` - and currently points to Cloudflare's edge, where it serves my own blog, gavinj.net. I do not know whether that is a redirect, a CNAME, or just Rob poking me in the ribs from a thousand kilometres away.

Either way, it is real: type `🍆.prawnburrito.com` into a browser that understands it and you end up on a page with my name in the title.

## How emoji domains work, briefly

The Domain Name System only speaks ASCII. To get Unicode characters into DNS, the Internationalized Domain Name system encodes them with Punycode. Any non-ASCII label is translated into an `xn--` form before it is queried.

For example:

| What a human sees | What DNS sees |
|---|---|
| `🍆` | `xn--gi8h` |

The browser does the translation in the background. If it accepts the label, you see the emoji. If it does not, you see the Punycode, or nothing at all.

There is a small list of symbols that work without Punycode - the trademark, information and circled-M emojis - but almost every other emoji has to go through this conversion. That is why `🍆.prawnburrito.com` is really `xn--gi8h.prawnburrito.com` under the hood.

## The security side: spoofing and trust

The obvious risk with any IDN is a homograph attack. A Cyrillic `a` looks identical to a Latin `a`, so `apple.com` and `аpple.com` can render the same way even though they point to different places. Browsers have spent years tightening which scripts can appear together in a single label to stop this.

Emoji raise the same trust problem in a louder, sillier package. A link that says `🍆.legitbank.com` in one app might expand to `xn--gi8h.legitbank.com` in another. Most users have no idea the two are the same address. Worse, some email clients and messaging apps will not hyperlink an emoji URL at all, so an attacker can hide the real destination behind pasted text that *looks* clickable.

It is not that emoji domains are inherently malicious. The issue is that they add a layer of indirection between what people read and what the machine resolves. Anything that widens that gap is useful to phishers.

ICANN's position is essentially: emoji do not belong in the stable, globally consistent part of the DNS hierarchy. That is why they are barred from new gTLDs and from the second level of `.com`. Subdomains are the wild west, which is how Rob got away with it.

## The usability side: emoji was not made for typing

Even if you trust the domain, getting to it is harder than it looks.

- **Typing.** On a phone you can long-press the globe key and hunt for the eggplant. On a desktop you need an emoji picker, a compose sequence, or a copied character. It is faster to type `xn--gi8h.prawnburrito.com`, which rather defeats the point.
- **Copy and paste.** Behaviour varies between operating systems, browsers, and apps. Some paste the emoji. Some paste the Punycode. Some paste nothing useful at all.
- **Email.** Many mail clients will not auto-link an emoji URL. Recipients have to copy it manually, at which point the visual pun is more trouble than it is worth.
- **Certificates.** A TLS certificate issued for `prawnburrito.com` will cover `🍆.prawnburrito.com` if it is a wildcard. A certificate issued for the Punycode label alone is valid too. The mismatch between what users see and what is cryptographically bound to the name is another small source of friction.

In short, emoji URLs work best when the URL is shown to you by someone else: a QR code, a poster, a social post, or a prank. They are not practical for anything you expect people to type from memory.

## What I took away from it

Rob's subdomain is harmless. It is a joke that happens to sit on a real DNS record, and it is a neat demonstration that the internet will let you do things the standards bodies quietly wish you would not.

But the exercise also shows why the standards bodies said no. Emoji in domain names create a gap between appearance and identity. They make URLs harder to type, harder to verify, and easier to misuse. For a marketing campaign with a controlled audience they might be fun. For everyday navigation or security-critical links they are a bad idea dressed up as a cute one.

And yes - Rob is still a smart arse.