In more detail
The DNS only accepts letters, digits and hyphens, so each label of an internationalised name is converted separately: its ASCII characters are kept, and the others are encoded in a suffix after the last hyphen, with xn-- added in front. Browsers show the readable Unicode form only when they judge it safe and fall back to the xn-- form for suspicious mixes of scripts. Certificates, DNS records and mail headers always contain the xn-- form.
Why it matters
Lookalike characters from other scripts can be used to imitate a real domain (a homograph attack), so a suspicious link whose hostname starts with xn-- deserves a decoding check. When configuring DNS or a certificate for an accented domain, you enter the Punycode form.
Example
münchen.de is stored as xn--mnchen-3ya.de: mnchen keeps the ASCII letters and 3ya encodes the ü and its position. A fake аpple.com whose first letter is the Cyrillic а becomes xn--pple-43d.com, although it looks identical on screen.
Common confusion
Punycode applies only to host names. Non-ASCII characters in the path or query string of a URL are percent-encoded instead, so ü becomes %C3%BC.