What is a domain generation algorithm?
A domain generation algorithm (DGA) is a routine built into malware that produces a long list of domain names from a shared seed, such as the current date. Every infected host runs the same algorithm and tries the domains one after another until one resolves to a live command-and-control (C2) server. The attacker runs the same code, knows which names will come up on a given day, and registers only one or a few of them. Defenders face the opposite problem: to cut the bots off, they would have to block or seize every candidate, every day.
Why malware uses DGAs
A C2 address hardcoded into malware is a single point of failure. Once analysts pull it out of a sample, the domain gets blocked, sinkholed or taken down, and every infected host goes quiet. A DGA turns that one name into a moving target. Conficker, the worm that spread widely in 2008 and 2009, is the classic case: a later variant generated 50,000 candidate domains a day, and a coalition of researchers, domain registries and vendors spent months trying to keep those names out of the attackers' hands.
What DGA traffic looks like
Most generated names are never registered, so an infected host produces bursts of failed lookups. A DNS log for one workstation might show:
| Query | Response |
|---|---|
| qxv7lt2mz9kd.example | NXDOMAIN |
| h4pwr0ce8nbs.example | NXDOMAIN |
| zt1kd9wq3vmo.example | NXDOMAIN |
| m8fy2lqe0xrt.example | 203.0.113.47 |
Dozens or hundreds of NXDOMAIN responses in a short burst, for long names that look like random characters, followed by one successful lookup that points to an address with no business purpose, is a strong DGA indicator. Other signs are high character entropy in the names, unusual or cheap top-level domains, and domains registered in the last few days. Some DGAs build names by joining dictionary words instead of random characters, which defeats simple randomness checks, so detection also weighs query volume and failure rates.
Detecting and disrupting DGAs
- Log DNS centrally and make clients use internal resolvers, blocking outbound DNS and unapproved DNS over HTTPS so malware can't go around them.
- Alert on NXDOMAIN spikes per host and on high-entropy names; machine learning classifiers trained on known DGA families help.
- Use protective DNS or DNS filtering that blocks newly registered and known DGA domains.
- Sinkhole predicted domains. Once researchers reverse-engineer an algorithm, they can calculate future names, register or redirect them, and use the sinkhole to count infected hosts and notify their owners.
- Treat the source as infected: the device generating the lookups is compromised, so isolate it and investigate with EDR.
DGA vs. related techniques
- Fast flux: keeps one domain but rotates the IP addresses behind it rapidly; a DGA rotates the domain names themselves. Some malware uses both.
- DNS tunneling: hides data inside DNS queries and responses; a DGA uses DNS only to locate the server.
- Typosquatting: registers misspellings of real brands to fool people; DGA names are meant for machines, not humans.
- Beaconing: the regular check-ins that follow once the malware has found its server.
Domain generation algorithm on the CompTIA Security+ exam
In SY0-801, domain generation algorithms are taught as a domain-based indicator of compromise among the signs of malicious activity in objective 2.5. Scenario wording such as "a host makes thousands of DNS queries for random-looking domains", "a large number of NXDOMAIN responses from one workstation" or "the malware's C2 domain changes every day" points to a DGA and an infected host. Distractors include DNS poisoning, DNS tunneling, typosquatting and a misconfigured DNS server. The best response is to isolate the host and block the domains that resolved, with DNS logging and filtering as the longer-term controls.