What is a Domain Generation Algorithm (DGA)?

Why DGA activity matters

Defenders usually want malicious infrastructure to be predictable enough to block. Domain generation algorithms do the opposite. They turn one hardcoded beacon into a moving calendar of possible hostnames, which means takedowns become a race against math rather than a one-time blocklist update.

That matters in practice because the infected device does not need a live domain list shipped in advance. It only needs the same seed, date rule, or pseudo-random routine as the attacker. Once both sides run the same logic, they can rendezvous through whatever generated domains the attacker decides to register that day.

What a DGA actually produces

A DGA does not magically compromise DNS. It manufactures candidate labels, often based on time, bot identifiers, or embedded seeds, then asks the resolver whether any of them exist. Malware families differ widely in style and volume.

How DGA-based command lookup works

Detection signals worth combining

No single clue proves DGA use. Strong detections usually combine lexical analysis, resolver telemetry, host context, and threat intelligence.

Where sinkholing helps

Sinkholing is powerful because it turns predicted attacker rendezvous points into defender-controlled telemetry. If responders can register likely future domains or redirect them through policy controls, infected hosts reveal themselves by attempting to connect.

Sinkholing is not a complete fix. It buys visibility, deprives the actor of reachability for that domain set, and can reduce harm while remediation teams remove the malware. If the actor changes seeds or ships an updated algorithm, the campaign can reappear under a new domain schedule.

• Collect resolver logs with endpoint identity so DGA lookups can be tied back to the infected asset.
• Correlate repeated NXDOMAIN bursts with process telemetry, not just user identity.
• Score suspicious domains with more than entropy alone to avoid flagging CDNs, test environments, or generated hostnames that are legitimate.
• Reverse-engineer recovered malware samples when possible so future candidate domains can be predicted instead of merely observed.
• Use sinkholing deliberately and with legal or policy approval, especially when registering expected future domains.
• Block at the domain layer first; chasing every resolved IP is brittle because the actor can move hosting quickly.
• Preserve telemetry from negative responses because failed lookups are often the earliest signal.
• Treat DGA detections as endpoint incidents, not just DNS anomalies, because the root problem is an infected host.

Common investigation traps

Two mistakes show up often. The first is assuming every random-looking domain is malicious. Build pipelines, preview environments, tracking IDs, and some SaaS hostnames can look algorithmic while being perfectly normal for that organization.

The second is focusing only on the domain that finally resolved. In many DGA cases, the best evidence is the sequence of failed lookups that happened before the successful one. Keeping those negative responses in your hunt data makes a major difference.

The practical takeaway

A domain generation algorithm (DGA) gives malware a renewable list of possible rendezvous domains, which makes fixed indicator blocking less durable than defenders want.

The best response blends DNS telemetry, host investigation, reverse engineering, and selective sinkholing. When you can predict the algorithm instead of reacting to one domain at a time, the defender regains leverage.