# Domain generation algorithm (DGA)

A domain generation algorithm (DGA) lets malware compute a new list of rendezvous domains every day, so defenders cannot block a fixed address.

## How it works

Malware and its operator share an algorithm and a seed (often the date). The operator registers a few of the generated names; infected machines try them all until one answers.

The resulting names usually look random, which is also how many are detected.

## How to protect yourself

- Flag DNS queries for long random-looking names, especially many failed ones from one host.
- Blocklists built from reversed DGAs can pre-empt future names.

## Related tools

- [DNS over HTTPS Lookup](https://phishdestroy.io/developer-tools/dns-over-https-lookup)
- [Blocklist Converter](https://phishdestroy.io/developer-tools/blocklist-converter)

## Related terms

- [Fast flux](https://phishdestroy.io/glossary/fast-flux/)
- [Indicator of compromise (IOC)](https://phishdestroy.io/glossary/ioc/)

## Further reading

- [Phishing Takedowns: Detect, Verify, Report](https://phishdestroy.io/takedown-anatomy)

## Glossary

- [All terms](https://phishdestroy.io/glossary/)

Canonical: https://phishdestroy.io/glossary/dga/