The DNS was built for letters a to z, digits and the hyphen. To support other scripts without changing DNS software, IDNA defines a conversion: each label with non-ASCII characters is normalised and encoded with Punycode, and the prefix xn-- is added. The Unicode form (the U-label) is what people read; the xn-- form (the A-label) is what is registered, queried and put into certificates.
Which characters are allowed is decided per TLD: every registry publishes IDN tables listing the permitted code points, and many bundle or block variants that could be confused with each other. So a name with Turkish characters may be registrable under .com.tr and .com but not under a TLD whose tables do not include those letters.
Because different scripts contain look-alike letters, IDNs can be abused for homograph attacks, where a name looks like a well-known brand but uses a different character. Browsers therefore display the xn-- form when a label mixes scripts suspiciously. Email with non-ASCII domains is supported less consistently than the web, which is worth testing before relying on an IDN for mail.
Example
bücher.example → xn--bcher-kva.example
çiçek.example → xn--iek-1lab.example