Switch to IDNA2008 non-transitional processing (and use libidn2 for that)
Copied here from https://bugs.isc.org/Ticket/Display.html?id=36101
The most current (and maintained) implementation of IDNA is libidn2 and that what we should be using. Moreover the DNS world just needs to bite the bullet and switch to IDNA2008 non-transitional processing and finally be done with that.
Firefox, curl and wget have already switched to IDNA2008 non-transitional, and it's not like dig/host/nslookup IDNA processing would have any security implications like with the web browser software.