It depends on whether you process IDNs before or after the IDN toASCII algorithm. (that is, do you see the domain name παράδειγμα.δοκιμή
as παράδειγμα.δοκιμή
or as xn--hxajbheg2az3al.xn--jxalpdlp
In the latter case - where you are handling IDNs through the punycode, then the old RFC 1123 rules apply:
U+0041 through U+005A (A-Z), U+0061 through U+007A (a-z) case folded as each other, U+0030 through U+0039 (0-9) and U+002D (-). [edit: and U+002E (.) of course; the rules for labels allow the others, with dots between labels, sometimes it's the obvious bits that are easiest to forget]
If you are seeing it in IDN form, the allowed characters are much varied, see http://unicode.org/reports/tr36/idn-chars.html for a handy chart of all valid characters.
Chances are your network code will deal with the punycode, but your display code (or even just passing strings to and from other layers) with the more human-readable form as nobody running a server on the السعودية. domain wants to see their server listed as being on .xn--mgberp4a5d4ar