RFC 1123 specifies the preferred format, not what is mandatory. This is clarified in RFC 2181: "The DNS itself places only one restriction on the particular la

RFC 1123 specifies the preferred format, not what is mandatory. This is clarified in RFC 2181: "The DNS itself places only one restriction on the particular labels that can be used to identify resource records. That one restriction relates to the length of the label and the full name. The length of any one label is limited to between 1 and 63 octets. A full domain name is limited to 255 octets (including the separators). The zero length full name is defined as representing the root of the DNS tree, and is typically written and displayed as ".". Those restrictions aside, any binary string whatever can be used as the label of any resource record. Similarly, any binary string can serve as the value of any record that includes a domain name as some or all of its value (SOA, NS, MX, PTR, CNAME, and any others that may be added). Implementations of the DNS protocols must not place any restrictions on the labels that can be used." You are correct that it can not be used in a hostname and I am not sure how it should be encoded when used in a URI, but for a domain name it is perfectly valid. Indeed, I tested this on my local DNS server running Knot and I can create a domain name with colons in it and it also resolves using dig.