Does anyone know where he is? If not, is there an accepted practice to
resolve this situation? Should I upload my own 'idna2' package.
Generally we try to contact the maintainer (and give him/her enough time to reply, in case he/she is e.g. on vacation). After that someone can announce their intention to take over maintenance of the package.