fix: reject an underscore in the last domain label

The last label allowed "_" with or without rfc_2782, so foo.ba_r validated.

Author: SashaMIT

CHANGES.md

@@ -9,6 +9,12 @@ Note to self: Breaking changes must increment either
 
 -->
 
+## Unreleased
+
+_**Fixes**_
+
+* Reject an underscore in the last domain label. ([#484](https://github.com/python-validators/validators/issues/484))
+
 ## 0.35.0 (2025-05-01)
 
 _**Breaking**_ ⚠️

src/validators/domain.py

@@ -90,8 +90,9 @@ def domain(
             + rf"(?:[a-z0-9-{service_record}]{{0,61}}"
             # Hostname
             + rf"[a-z0-9{service_record}])?\.)"
-            # First 61 characters of the gTLD
-            + r"+[a-z0-9][a-z0-9-_]{0,61}"
+            # First 61 characters of the gTLD. An underscore belongs
+            # in a service label, not here.
+            + r"+[a-z0-9][a-z0-9-]{0,61}"
             # Last character of the gTLD
             + rf"[a-z]{trailing_dot}",
             value.encode("idna").decode("utf-8"),

tests/test_domain.py

@@ -74,6 +74,9 @@ def test_returns_true_on_valid_top_level_domain(
         ("__exa__mple__.com", False, True),
         ("a......b.com", False, False),
         ("a.123", False, False),
+        ("foo.ba_r", False, False),
+        ("foo.ba_r", False, True),
+        ("example.co_uk", False, False),
         ("123.123", False, False),
         ("123.123.123.", True, False),
         ("123.123.123.123", False, False),