What Is a DGA? How Malware Generates Domain Names

A DGA (Domain Generation Algorithm) is a technique that lets malware reach its command-and-control (C2) server not through a fixed address, but by algorithmically generating hundreds or even thousands of new domain names every day. The goal is simple: a single domain can be blocklisted or seized, but thousands of candidate addresses that change daily render classic blocking useless.

Why did DGAs appear?

Early malware embedded its C2 server addresses directly in the code. Once defenders identified and blocked those addresses — or seized the domains — the entire botnet went dark. DGAs were developed to remove this single point of failure and spread with major botnets such as Conficker and Necurs. Today, DGA variants are used by many modern malware families, including ransomware.

How does a DGA work?

1. Shared seed: The malware and the attacker use the same algorithm with the same starting value. The seed is usually the date; some families have used harder-to-predict seeds such as exchange rates or social media data.
2. Generation: Each day the algorithm produces a fresh candidate list: hundreds of seemingly random domains like `qkxvbd73h.com` or `mpa2tr9wq.net`.
3. Rendezvous: The attacker registers only a few of the candidates in advance. The malware queries candidates in order; when it reaches a registered one, the C2 connection is established.
4. Persistence: Even if defenders block today's domain, tomorrow's freshly generated list re-establishes the connection.

This mechanism leaves a distinctive trace in DNS: because the vast majority of candidates are unregistered, an infected device receives a large number of NXDOMAIN (non-existent domain) responses. That trail is one of the strongest signals for DGA detection.

How are DGA domains detected?

Dictionary and signature approach

The algorithms of known DGA families can be reverse-engineered, and the domains they will generate can be precomputed. Effective for known families; late for new or modified algorithms.

Statistical and linguistic analysis

DGA-generated domains differ measurably from names chosen by humans:

• High entropy: Character distribution approaches randomness, with no pronounceable syllable structure.
• N-gram anomaly: The distribution of letter pairs and triplets does not match natural language.
• Length and structure patterns: Domains produced by the same family share similar lengths and character sets.

Behavioral context

How a domain is queried carries as much information as the name itself: recent registration, short TTLs, a dense NXDOMAIN series from a single device, and query timing — evaluated together, they drive the false positive rate down sharply. This holistic analysis shares its foundation with DNS tunneling detection.

Machine learning

Modern detection uses classifiers that take all of these signals as features. The critical design question is where the model runs: a cloud-hosted model requires the organization's DNS queries to be sent out for analysis, while an on-premise model performs the same detection without data leaving the organization.

What should happen when a DGA is detected?

1. Block the domain and the family: Not just one domain — queries matching the detected pattern must be blocked, or tomorrow's generation will walk right past the block.
2. Find the source device: A device making DGA queries is almost certainly infected. User mapping (Active Directory) reduces response time to minutes.
3. Isolate and clean the device: The DNS block severs the C2 connection but does not remove the malware; endpoint response is essential.
4. Correlate the event in the SIEM: Combined with other anomalies from the same device, a DGA detection reveals the full scope of the attack.

You can see how DNS-layer analysis — including DGA detection — works at the module level on the Obsolix Platform page.

Frequently asked questions

Can't DGA domains be blocked with a blocklist?

In practice, no. With hundreds of new names generated daily, a blocklist is always behind. Effective defense looks at the generation pattern and query behavior, not the domain name itself.

Is every NXDOMAIN spike a DGA?

No; typos, misconfigured applications and some CDN behaviors also produce NXDOMAIN responses. The distinction comes from evaluating entropy, timing and other signals together — systems that rely on a single metric drown in false alarms.

Are DGAs only found in large botnets?

No. DGA libraries have made their way into commodity malware families; they can be encountered on any network, regardless of organization size.