Anti-DGA
Navigation: DNS Security → Anti-DGA
A domain-generation algorithm (DGA) produces large sets of seemingly random names so malware can find its command-and-control server even after individual domains are taken down. TOORCE scores names for DGA-like structure and blocks or logs them before the client connects.
What is detected
| Signal | Description |
|---|---|
| Algorithmically generated labels | Pronounceability, character distribution, and length unlike real brands |
| NXDOMAIN storms | Many generated names fail until one is registered — a classic DGA pattern |
| No web category / no reputation | Combined with DGA score, unknown + generated is high risk |
| Client fan-out | One host querying many unique, short-lived names in a short window |
Anti-DGA complements Threat Intelligence. Feeds catch known C2 names; DGA detection catches not-yet-listed generated names.
Typical log
{
"src_ip": "192.168.1.77",
"domain": "xqjrmvlahtoe.com",
"qtype": "A",
"dnssec": "unsigned",
"category": "unknown",
"reputation": "suspicious",
"action": "block",
"reason": "DGA domain"
}
Recommended policy
| Setting | Recommended | Notes |
|---|---|---|
| Anti-DGA | On | Enable on user and server VLANs |
| High DGA score | Block | Lowest false-negative posture |
| Medium score | Log / alert | Review in DNS Security Logs |
| Pair with NXDOMAIN limits | On | See Anomaly Protection |
| Allow-list | Rare | Only for known-good names that look random (some tracking/CDN hosts) |
Relationship to other engines
| Engine | Difference |
|---|---|
| Threat Intelligence | Listed malicious domains |
| Anti-Tunneling | Encoded data in labels / TXT volume |
| Anomaly Protection | Query floods and NXDOMAIN rate, regardless of name shape |
| DNS Filtering | Human categories, not generated-name scoring |