@whitequark yeah idna is difficult
i think the key sentence is “This option corresponds to the UseSTD3ASCIIRules flag in UTS #46.” and in tr46 that flag basically enables or disables all hostname syntax checks, hence allowing * and everything else i bet
the approach i would take is to do idna conversion with UseSTD3ASCIIRules=false then check that the resulting punycode obeys the relaxed hostname-with-underscore syntax
on the basis that idna is designed so that it works when trad syntax is enforced by various lower layers