diff --git a/cmd/ctwatch/main.go b/cmd/ctwatch/main.go
index b8a0fe3..e669e69 100644
--- a/cmd/ctwatch/main.go
+++ b/cmd/ctwatch/main.go
@@ -22,6 +22,14 @@ func DefaultStateDir () string {
 	}
 }
 
+func trimTrailingDots (value string) string {
+	length := len(value)
+	for length > 0 && value[length - 1] == '.' {
+		length--
+	}
+	return value[0:length]
+}
+
 var stateDir = flag.String("state_dir", DefaultStateDir(), "Directory for storing state")
 var watchDomains []string
 var watchDomainSuffixes []string
@@ -38,7 +46,7 @@ func setWatchDomains (domains []string) error {
 			watchDomainSuffixes = []string{""}
 			break
 		} else {
-			asciiDomain, err := idna.ToASCII(strings.ToLower(domain))
+			asciiDomain, err := idna.ToASCII(strings.ToLower(trimTrailingDots(domain)))
 			if err != nil {
 				return fmt.Errorf("Invalid domain `%s': %s", domain, err)
 			}
diff --git a/identifiers.go b/identifiers.go
index d92c6b2..d3e3c25 100644
--- a/identifiers.go
+++ b/identifiers.go
@@ -87,9 +87,17 @@ func isValidDNSLabel (label string) bool {
 	return true
 }
 
+func trimTrailingDots (value string) string {
+	length := len(value)
+	for length > 0 && value[length - 1] == '.' {
+		length--
+	}
+	return value[0:length]
+}
+
 // Convert the DNS name to lower case and replace invalid labels with a placeholder
 func sanitizeDNSName (value string) string {
-	value = strings.ToLower(value)
+	value = strings.ToLower(trimTrailingDots(value))
 	labels := strings.Split(value, ".")
 	for i, label := range labels {
 		if !isValidDNSLabel(label) {
@@ -101,7 +109,7 @@ func sanitizeDNSName (value string) string {
 
 // Like sanitizeDNSName, but labels that are Unicode are converted to Punycode.
 func sanitizeUnicodeDNSName (value string) string {
-	value = strings.ToLower(value)
+	value = strings.ToLower(trimTrailingDots(value))
 	labels := strings.Split(value, ".")
 	for i, label := range labels {
 		if asciiLabel, err := idna.ToASCII(label); err == nil && isValidDNSLabel(asciiLabel) {