"
Could you perhaps look at the IDN spec to see what code-points / ranges they've excluded? [...]
"
This will rather unhelpful since the IDN spec is very lenient, only forbidding code points with property "Separator" (Z) and "Other" as you may remember from this pull request to NNF
https://github.com/Kroc/NoNonsenseForum/pull/118

"
[...]There may also be libraries out there that process IDNs, and therefore include anti-spoofing. I'm not quite sure how one would make something accurate without having to paint a broad brush across the unicode space because it's unreasonable for anybody to have to go through the whole unicode space to find untrustworthy symbols.
"
TLDs that are deemed "trustworthy" by browsers, to have their domainnames displayed as unicode all have rather short, individual white-lists.
For example the Swedish TLD ".se" allow "0-9,a-z,å,ä,ö" if I recall correctly.

:: @Akerhielm added on 23 Apr ’13 · 09:59

Turns out I'm an idiot and forgot how to quote.