diff --git a/idna/idna.go b/idna/idna.go
index 7d328fcb0..346fe4423 100644
--- a/idna/idna.go
+++ b/idna/idna.go
@@ -309,7 +309,7 @@ func (p *Profile) process(s string, toASCII bool) (string, error) {
 		for ; len(s) > 0 && s[0] == '.'; s = s[1:] {
 		}
 	}
-	// TODO: allow for a quick check the tables data.
+	// TODO: allow for a quick check of the tables data.
 	// It seems like we should only create this error on ToASCII, but the
 	// UTS 46 conformance tests suggests we should always check this.
 	if err == nil && p.verifyDNSLength && s == "" {
@@ -405,6 +405,9 @@ func validateRegistration(p *Profile, s string) (idem string, bidi bool, err err
 	}
 	for i := 0; i < len(s); {
 		v, sz := trie.lookupString(s[i:])
+		if sz == 0 {
+			return s, bidi, runeError(utf8.RuneError)
+		}
 		bidi = bidi || info(v).isBidi(s[i:])
 		// Copy bytes not copied so far.
 		switch p.simplify(info(v).category()) {
@@ -446,6 +449,15 @@ func validateAndMap(p *Profile, s string) (vm string, bidi bool, err error) {
 	var combinedInfoBits info
 	for i := 0; i < len(s); {
 		v, sz := trie.lookupString(s[i:])
+		if sz == 0 {
+			b = append(b, s[k:i]...)
+			b = append(b, "\ufffd"...)
+			k = len(s)
+			if err == nil {
+				err = runeError(utf8.RuneError)
+			}
+			break
+		}
 		combinedInfoBits |= info(v)
 		bidi = bidi || info(v).isBidi(s[i:])
 		start := i
@@ -584,6 +596,9 @@ func validateFromPunycode(p *Profile, s string) error {
 	// loop.
 	for i := 0; i < len(s); {
 		v, sz := trie.lookupString(s[i:])
+		if sz == 0 {
+			return runeError(utf8.RuneError)
+		}
 		if c := p.simplify(info(v).category()); c != valid && c != deviation {
 			return &labelError{s, "V6"}
 		}