diff --git a/core/modules/system/system.install b/core/modules/system/system.install
index ce48afe725..af177f9304 100644
--- a/core/modules/system/system.install
+++ b/core/modules/system/system.install
@@ -32,6 +32,24 @@ function system_requirements($phase) {
   global $install_state;
   $requirements = [];
 
+  // Subdomain validation.
+  // $_SERVER['HTTP_HOST'] is not assumed in core and could be on
+  // $_SERVER['SERVER_NAME']. Henceforth checking both of them.
+  $http_host = \Drupal::request()->getHttpHost();
+  if (strpos($http_host, '_') !== FALSE || (isset($_SERVER['SERVER_NAME']) && strpos($_SERVER['SERVER_NAME'], '_') !== FALSE)) {
+    // Domain-name requirements are specified in RFCs 952 and 1123, and the
+    // underscore character is not permitted. Whilst most browsers will still
+    // show the web site, Internet Explorer will silently drop any cookies from
+    // that domain, which means Internet Explorer users will not be able to log
+    // in.
+    $requirements['hostname'] = [
+      'title' => t('Host name'),
+      'value' => t('Fails'),
+      'severity' => REQUIREMENT_WARNING,
+      'description' => t('Host names should not include an underscore, like in %domain. Whilst most browsers will still function, Internet Explorer will appear to serve the web site, but will silently drop all cookies for the domain, preventing Internet Explorer users from logging in.', ['%domain' => $http_host]),
+    ];
+  }
+
   // Report Drupal version
   if ($phase == 'runtime') {
     $requirements['drupal'] = [