zBLD vs. DGA — Detecting Algorithmically Generated Domains
Malware and botnets use Domain Generation Algorithms (DGA) to generate hundreds or thousands of short-lived domains for communication with command-and-control infrastructure.
An attack example from real OpenBLD logs:
s-dfgfd-sdfz...zdssragv[.]mom96bccebb2f7e...wu7y6z[.]com60r...60pg0131[.]cc- and billions of similar domains.
Why are DGA domains harmful?
Beyond their malicious purpose, this chaotic DNS traffic pollutes resolver caches, increases CPU and I/O usage, and generates large volumes of low-value logs. At scale, it can cause higher resource consumption and degraded DNS performance.
Why signatures and blacklists are not enough
Traditional signatures and static blocklists are often ineffective against DGA traffic because generated domains may exist for only minutes and can change continuously.
By the time a domain is added to a conventional threat feed, the malware may already be using another one.
The OpenBLD approach
OpenBLD uses proactive analysis: a detection algorithm operating against a generation algorithm.
The zBLD detection system analyzes suspicious domain characteristics in real time and blocks domains that match DGA behavior without disrupting legitimate traffic.
OpenBLD's DGA detection has been continuously improved and used in production since 2025. Before production deployment, it spent approximately one year in development, testing, and read-only observation mode.
The result
DGA-generated junk traffic is blocked before it consumes system resources.
This helps OpenBLD:
- protect users from malware and botnet infrastructure;
- reduce DNS cache pollution;
- lower unnecessary CPU and I/O usage;
- limit junk log generation;
- maintain fast DNS response times.
Engineering in detail: speed and protection at the intersection of algorithms.
Learn more about OpenBLD secure DNS.
Updates
Follow the official OpenBLD Telegram channel.