What is fast flux, and how do you detect it in DNS?

Fast flux is a technique where attackers rapidly change the DNS records, usually the IP addresses, tied to one domain. Malware keeps reaching its command server while IP blocklists go stale within minutes. A joint advisory from several national agencies calls it a gap in many networks' defenses.

What is the difference between single and double flux?

The April 2025 joint advisory (AA25-093A, from NSA, CISA, FBI and partner agencies in Australia, Canada and New Zealand) describes two variants.

In single flux, one domain name maps to many IP addresses, and the set rotates often in DNS answers. Block one address and the domain still resolves to the others.

In double flux, the name servers that answer for the domain also change frequently, using NS and CNAME records. That adds another layer of redundancy and makes the operators harder to trace.

Both lean on large numbers of compromised hosts, typically a botnet, acting as proxies or relays. The advisory says this makes it hard for defenders to block traffic and for law enforcement to take infrastructure down.

Why do attackers like it?

The advisory lists three advantages: resilience, because rotating through botnet devices outpaces abuse reports and takedowns; ineffective IP blocking, because an address may be unused by the time it is blocked; and anonymity, because investigators chase infrastructure that keeps moving.

It also appears beyond command and control. The agencies note it is used to keep phishing sites online and to keep criminal forums and marketplaces available. They cite bulletproof hosting providers that sell fast flux as a service feature, and report its use in Hive and Nefilim ransomware attacks and by the Gamaredon group.

Is every fast-changing domain malicious?

No, and this is the main source of false positives. The advisory notes that content delivery networks and load balancers legitimately return rotating addresses for performance. Its guidance says defenders should make reasonable efforts, such as allowlisting expected CDN services, so legitimate content is not blocked.

Which signals point to malicious fast flux?

The advisory gives a list of detection ideas for ISPs and protective DNS providers, and several work for your own resolver logs:

• Domains that cycle through tens or hundreds of IP addresses per day.
• Unusually low time-to-live (TTL) values. The advisory says a typical fast flux domain may change address every 3 to 5 minutes.
• Inconsistent IP geolocation across answers for one domain.
• Flow data showing large-scale contact with many different addresses in a short period.
• High entropy or IP diversity in DNS query logs.
• Phishing activity that correlates with the same domains.

The agencies are candid that separating malicious from legitimate fast flux remains an ongoing challenge.

A constructed example

A resolver log shows a domain that is only a few days old. In one hour it returns 40 distinct addresses across a dozen countries, each with a TTL of 120 seconds, and three workstations query it every few minutes. A CDN-hosted site might also rotate addresses, but it would be well known, stable over months, and not queried on a timer by a few endpoints. The timer pattern is the lead worth chasing: check the workstations for the process making the lookups.

How to check or apply this

1. Log DNS queries and answers, not only blocked requests. You cannot hunt for rotation without the history.
2. Build a query that flags new domains with high address churn and short TTLs, then review hits against a CDN allowlist.
3. Ask your protective DNS provider directly whether it detects and blocks fast flux. The advisory says not to assume it does, and to validate coverage.
4. Block or sinkhole confirmed domains. Sinkholing redirects traffic to a server you control, which also reveals which internal hosts are infected.
5. Share indicators with trusted partners or a sector sharing group. The advisory notes most malicious activity on these domains happens within a few days of first use, so early sharing matters.
6. Train staff on phishing, since fast flux often supports the first step of a compromise.

Safeguard does not provide DNS filtering or network monitoring. Its relevance is upstream: finding vulnerable and malicious dependencies in your software before a compromised build reaches production and starts calling out.

Quick check

Sources

• CISA, NSA, FBI and partners: Fast Flux, A National Security Threat (AA25-093A), released 3 April 2025

Last reviewed: 18 October 2026.