What if we do limit it to the whitelisted set? We can expand the set over time without fear of breaking existing names.
I assume by ‘ignored’ you mean they should normalise to the non-tagged version?
Underscore should not be disallowed, I think. It’s theoretically disallowed in DNS, but in practice is used for a bunch of special-purpose stuff (dmarc, SPF etc).