diff --git a/core/src/main/java/google/registry/flows/host/HostFlowUtils.java b/core/src/main/java/google/registry/flows/host/HostFlowUtils.java
index c780701dcc5..bfc58c7b38c 100644
--- a/core/src/main/java/google/registry/flows/host/HostFlowUtils.java
+++ b/core/src/main/java/google/registry/flows/host/HostFlowUtils.java
@@ -17,6 +17,7 @@
 import static google.registry.flows.domain.DomainFlowUtils.validateFirstLabel;
 import static google.registry.model.EppResourceUtils.isActive;
 import static google.registry.model.tld.Tlds.findTldForName;
+import static google.registry.util.DomainNameUtils.canonicalizeHostname;
 import static google.registry.util.PreconditionsUtils.checkArgumentNotNull;
 import static java.util.stream.Collectors.joining;
 
@@ -34,7 +35,6 @@
 import google.registry.model.ForeignKeyUtils;
 import google.registry.model.domain.Domain;
 import google.registry.model.eppcommon.StatusValue;
-import google.registry.util.Idn;
 import java.net.InetAddress;
 import java.util.Optional;
 import org.joda.time.DateTime;
@@ -57,7 +57,7 @@ public static InternetDomainName validateHostName(String name) throws EppExcepti
       throw new HostNameNotLowerCaseException(hostNameLowerCase);
     }
     try {
-      String hostNamePunyCoded = Idn.toASCII(name);
+      String hostNamePunyCoded = canonicalizeHostname(name);
       if (!name.equals(hostNamePunyCoded)) {
         throw new HostNameNotPunyCodedException(hostNamePunyCoded);
       }
diff --git a/core/src/test/java/google/registry/flows/host/HostCreateFlowTest.java b/core/src/test/java/google/registry/flows/host/HostCreateFlowTest.java
index d1b682676a9..6c50a934ec6 100644
--- a/core/src/test/java/google/registry/flows/host/HostCreateFlowTest.java
+++ b/core/src/test/java/google/registry/flows/host/HostCreateFlowTest.java
@@ -45,6 +45,7 @@
 import google.registry.flows.host.HostFlowUtils.HostNameNotPunyCodedException;
 import google.registry.flows.host.HostFlowUtils.HostNameTooLongException;
 import google.registry.flows.host.HostFlowUtils.HostNameTooShallowException;
+import google.registry.flows.host.HostFlowUtils.InvalidHostNameException;
 import google.registry.flows.host.HostFlowUtils.LoopbackIpNotValidForHostException;
 import google.registry.flows.host.HostFlowUtils.SuperordinateDomainDoesNotExistException;
 import google.registry.flows.host.HostFlowUtils.SuperordinateDomainInPendingDeleteException;
@@ -82,9 +83,14 @@ private void setEppHostCreateInputWithIps(String hostName) {
   }
 
   private void doSuccessfulTest() throws Exception {
+    doSuccessfulTest("host_create_response.xml", ImmutableMap.of());
+  }
+
+  private void doSuccessfulTest(String responseFile, ImmutableMap<String, String> substitutions)
+      throws Exception {
     clock.advanceOneMilli();
     assertMutatingFlow(true);
-    runFlowAssertResponse(loadFile("host_create_response.xml"));
+    runFlowAssertResponse(loadFile(responseFile, substitutions));
     Host host = reloadResourceByForeignKey();
     // Check that the host was created and persisted with a history entry.
     assertAboutHosts()
@@ -134,6 +140,28 @@ void testSuccess_internalNeverExisted() throws Exception {
     assertHostDnsRequests("ns1.example.tld");
   }
 
+  @Test
+  void testSuccess_tldWithHyphenOn3And4() throws Exception {
+    setEppHostCreateInput("ns1.example.zz--main-2262", null);
+    doSuccessfulTest(
+        "host_create_response_wildcard.xml",
+        ImmutableMap.of("HOSTNAME", "ns1.example.zz--main-2262"));
+  }
+
+  @Test
+  void testFailure_domainWithHyphenOn3And4() throws Exception {
+    setEppHostCreateInput("ns1.zz--main-2262.tld", null);
+    EppException thrown = assertThrows(InvalidHostNameException.class, this::runFlow);
+    assertAboutEppExceptions().that(thrown).marshalsToXml();
+  }
+
+  @Test
+  void testFailure_hostnameWithHyphenOn3And4() throws Exception {
+    setEppHostCreateInput("zz--ns1.domain.tld", null);
+    EppException thrown = assertThrows(InvalidHostNameException.class, this::runFlow);
+    assertAboutEppExceptions().that(thrown).marshalsToXml();
+  }
+
   @Test
   void testFailure_multipartTLDsAndInvalidHost() {
     createTlds("bar.tld", "tld");
diff --git a/core/src/test/resources/google/registry/flows/host/host_create_response_wildcard.xml b/core/src/test/resources/google/registry/flows/host/host_create_response_wildcard.xml
new file mode 100644
index 00000000000..a4340c1b5b5
--- /dev/null
+++ b/core/src/test/resources/google/registry/flows/host/host_create_response_wildcard.xml
@@ -0,0 +1,18 @@
+<epp xmlns="urn:ietf:params:xml:ns:epp-1.0">
+  <response>
+    <result code="1000">
+      <msg>Command completed successfully</msg>
+    </result>
+    <resData>
+      <host:creData
+       xmlns:host="urn:ietf:params:xml:ns:host-1.0">
+        <host:name>%HOSTNAME%</host:name>
+        <host:crDate>1999-04-03T22:00:00.0Z</host:crDate>
+      </host:creData>
+    </resData>
+    <trID>
+      <clTRID>ABC-12345</clTRID>
+      <svTRID>server-trid</svTRID>
+    </trID>
+  </response>
+</epp>