diff --git a/core/src/test/java/google/registry/rdap/RdapActionBaseTestCase.java b/core/src/test/java/google/registry/rdap/RdapActionBaseTestCase.java
index b09d9b5b7..062badbd3 100644
--- a/core/src/test/java/google/registry/rdap/RdapActionBaseTestCase.java
+++ b/core/src/test/java/google/registry/rdap/RdapActionBaseTestCase.java
@@ -298,9 +298,13 @@ have failed to comply with these terms.",
     }
 
     JsonFileBuilder addNameserver(String name, String handle) {
+      return addNameserver(Idn.toASCII(name), name, handle);
+    }
+
+    JsonFileBuilder addNameserver(String punycodeName, String unicodeName, String handle) {
       return putNext(
-          "NAMESERVER_NAME_", Idn.toASCII(name),
-          "NAMESERVER_UNICODE_NAME_", name,
+          "NAMESERVER_NAME_", punycodeName,
+          "NAMESERVER_UNICODE_NAME_", unicodeName,
           "NAMESERVER_HANDLE_", handle);
     }
 
diff --git a/core/src/test/java/google/registry/rdap/RdapNameserverActionTest.java b/core/src/test/java/google/registry/rdap/RdapNameserverActionTest.java
index 4c916313f..513896f5a 100644
--- a/core/src/test/java/google/registry/rdap/RdapNameserverActionTest.java
+++ b/core/src/test/java/google/registry/rdap/RdapNameserverActionTest.java
@@ -17,6 +17,8 @@ package google.registry.rdap;
 import static com.google.common.truth.Truth.assertThat;
 import static google.registry.testing.DatabaseHelper.createTld;
 import static google.registry.testing.DatabaseHelper.persistResource;
+import static google.registry.testing.FullFieldsTestEntityHelper.makeAndPersistHost;
+import static google.registry.testing.FullFieldsTestEntityHelper.makePunycodedHost;
 import static google.registry.testing.FullFieldsTestEntityHelper.makeRegistrar;
 import static google.registry.testing.GsonSubject.assertAboutJson;
 import static org.mockito.Mockito.verify;
@@ -27,7 +29,6 @@ import google.registry.rdap.RdapMetrics.SearchType;
 import google.registry.rdap.RdapMetrics.WildcardType;
 import google.registry.rdap.RdapSearchResults.IncompletenessWarningType;
 import google.registry.request.Action;
-import google.registry.testing.FullFieldsTestEntityHelper;
 import java.util.Optional;
 import org.junit.jupiter.api.BeforeEach;
 import org.junit.jupiter.api.Test;
@@ -43,20 +44,17 @@ class RdapNameserverActionTest extends RdapActionBaseTestCase<RdapNameserverActi
   void beforeEach() {
     // normal
     createTld("lol");
-    FullFieldsTestEntityHelper.makeAndPersistHost(
-        "ns1.cat.lol", "1.2.3.4", clock.nowUtc().minusYears(1));
+    makeAndPersistHost("ns1.cat.lol", "1.2.3.4", clock.nowUtc().minusYears(1));
     // idn
     createTld("xn--q9jyb4c");
-    FullFieldsTestEntityHelper.makeAndPersistHost(
+    makeAndPersistHost(
         "ns1.cat.xn--q9jyb4c", "bad:f00d:cafe:0:0:0:15:beef", clock.nowUtc().minusYears(1));
     // multilevel
     createTld("1.tld");
-    FullFieldsTestEntityHelper.makeAndPersistHost(
-        "ns1.domain.1.tld", "5.6.7.8", clock.nowUtc().minusYears(1));
+    makeAndPersistHost("ns1.domain.1.tld", "5.6.7.8", clock.nowUtc().minusYears(1));
     // deleted
     persistResource(
-        FullFieldsTestEntityHelper.makeAndPersistHost(
-                "nsdeleted.cat.lol", "1.2.3.4", clock.nowUtc().minusYears(1))
+        makeAndPersistHost("nsdeleted.cat.lol", "1.2.3.4", clock.nowUtc().minusYears(1))
             .asBuilder()
             .setDeletionTime(clock.nowUtc().minusMonths(1))
             .build());
@@ -64,8 +62,7 @@ class RdapNameserverActionTest extends RdapActionBaseTestCase<RdapNameserverActi
     persistResource(
         makeRegistrar("otherregistrar", "Yes Virginia <script>", Registrar.State.ACTIVE, 102L));
     // external
-    FullFieldsTestEntityHelper.makeAndPersistHost(
-        "ns1.domain.external", "9.10.11.12", clock.nowUtc().minusYears(1));
+    makeAndPersistHost("ns1.domain.external", "9.10.11.12", clock.nowUtc().minusYears(1));
   }
 
   @Test
@@ -80,6 +77,14 @@ class RdapNameserverActionTest extends RdapActionBaseTestCase<RdapNameserverActi
     assertThat(response.getStatus()).isEqualTo(400);
   }
 
+  @Test
+  void testInvalidNameserver_domainWithHyphenOn3And4_returns400() {
+    assertAboutJson()
+        .that(generateActualJson("ns1.zz--main-2166.lol"))
+        .isEqualTo(generateExpectedJsonError("Not a valid nameserver", 400));
+    assertThat(response.getStatus()).isEqualTo(400);
+  }
+
   @Test
   void testUnknownNameserver_returns404() {
     assertAboutJson()
@@ -101,6 +106,21 @@ class RdapNameserverActionTest extends RdapActionBaseTestCase<RdapNameserverActi
     assertThat(response.getStatus()).isEqualTo(200);
   }
 
+  @Test
+  void testNameserver_tldTithHyphenOn3And4_works() {
+    createTld("zz--main-2166");
+    persistResource(makePunycodedHost("ns1.cat.zz--main-2166", "1.2.3.4", null, "TheRegistrar"));
+    assertAboutJson()
+        .that(generateActualJson("ns1.cat.zz--main-2166"))
+        .isEqualTo(
+            addPermanentBoilerplateNotices(
+                jsonFileBuilder()
+                    .addNameserver("ns1.cat.zz--main-2166", "ns1.cat.zz--main-2166", "F-ROID")
+                    .putAll("ADDRESSTYPE", "v4", "ADDRESS", "1.2.3.4", "STATUS", "active")
+                    .load("rdap_host.json")));
+    assertThat(response.getStatus()).isEqualTo(200);
+  }
+
   @Test
   void testTrailingDot_getsIgnored() {
     assertAboutJson()
diff --git a/core/src/test/java/google/registry/testing/FullFieldsTestEntityHelper.java b/core/src/test/java/google/registry/testing/FullFieldsTestEntityHelper.java
index eaadf9cee..e808fd40b 100644
--- a/core/src/test/java/google/registry/testing/FullFieldsTestEntityHelper.java
+++ b/core/src/test/java/google/registry/testing/FullFieldsTestEntityHelper.java
@@ -135,10 +135,15 @@ public final class FullFieldsTestEntityHelper {
 
   public static Host makeHost(
       String fqhn, @Nullable String ip1, @Nullable String ip2, String registrarClientId) {
+    return makePunycodedHost(Idn.toASCII(fqhn), ip1, ip2, registrarClientId);
+  }
+
+  public static Host makePunycodedHost(
+      String fqhn, @Nullable String ip1, @Nullable String ip2, String registrarClientId) {
     Host.Builder builder =
         new Host.Builder()
             .setRepoId(generateNewContactHostRoid())
-            .setHostName(Idn.toASCII(fqhn))
+            .setHostName(fqhn)
             .setCreationTimeForTest(DateTime.parse("2000-10-08T00:45:00Z"))
             .setPersistedCurrentSponsorRegistrarId(registrarClientId);
     if ((ip1 != null) || (ip2 != null)) {