Skip to main content
All glossary terms

Proxy & networking

Domain generation algorithm (DGA)

A domain generation algorithm (DGA) is a procedure that produces domain-name candidates from inputs such as a seed, time value, or internal state. Some malware uses DGAs to find command infrastructure, while similar generation techniques can also have benign uses.

Also known as DGA, domain generation algorithm.

Why it matters in practice

A large sequence of unusual or unsuccessful DNS lookups may help analysts detect automated behavior, but a DGA-like pattern is not conclusive proof of compromise. Monitoring combines query characteristics with host and threat context. DNS filtering may block known names, but generated names and changing infrastructure complicate static lists.

Example

A defender investigates a workstation that queries many random-looking names and correlates the activity with process and network telemetry.

Educational note

This definition is general information, not legal advice. It may omit facts that matter to a specific situation and does not establish or guarantee compliance.