Blocking a malicious server's IP address usually works. DNS fast flux is how attackers make sure it doesn't. In April 2025, the NSA, CISA, FBI and partner agencies in Australia, Canada and New Zealand issued a joint advisory calling fast flux a national security threat.
Key Takeaways
- DNS fast flux rotates the IP addresses behind a domain every few minutes, using hijacked devices as proxies.
- IP blocklists go stale too quickly to stop it, so defenders block the domain instead.
- Fast flux and domain generation algorithms keep botnets reachable in different ways, and many operations use both.
- Protective DNS spots fast flux from IP spread, network ownership and domain age, not from TTL alone.
What Is DNS Fast Flux?
DNS fast flux is a technique that rapidly changes a domain's DNS records, usually its IP addresses, to hide the servers behind it. According to the 2025 advisory, a fluxing domain may change its IP address every 3 to 5 minutes. Ransomware groups such as Hive and Nefilim have used it to keep phishing pages and command-and-control servers online.
{{cool-component}}
How DNS Fast Flux Works at the Network Level
Attackers control a botnet of compromised home routers and PCs, each running a small proxy. When someone looks up the domain, the attacker's DNS server returns a handful of these proxy IPs with a very short TTL. Each proxy relays requests to a hidden backend server, often called the mothership. Minutes later, the same lookup returns different proxies. In one 2026 case, each answer held 10 to 18 residential IPs, drawn from 18 countries in total and replaced every two to three minutes.
Why Fast Flux Is Difficult to Block With Traditional IP-Based Controls
IP blocklists assume an address stays malicious for a while. With fast flux, the domain has moved on before a firewall rule is even written. Many of the addresses are dynamic residential IPs that will later belong to innocent users, so blocking them causes collateral damage. Some bulletproof hosting providers sell fast flux as a feature for exactly this reason. Effective DNS security therefore targets the domain and its behavior, not individual IPs.
How Fast Flux Relates to Domain Generation Algorithms and Botnet Infrastructure
Fast flux keeps one domain alive by changing its IPs. A domain generation algorithm (DGA) does the reverse, producing many new domain names so that blocking one doesn't cut off the malware. Some operations combine both: the DGA tells infected machines which domain to try, and fast flux points that domain at a changing pool of proxies drawn from the same botnet. That overlap is why botnet detection and fast flux detection often share data.
{{cool-component}}
How DNS Filtering and Threat Intelligence Detect Fast Flux Activity
Detection compares answers across many lookups. Strong signals include:
- Many unrelated IPs for one domain in a short time
- IPs spread across many ISPs, ASNs and countries
- Residential addresses rather than data center ranges
- Newly registered or newly seen domains
Protective DNS services and DNS filtering tools combine these signals with threat intelligence feeds and block matching domains at the resolver. The 2025 advisory recommends confirming that your provider actually blocks fast flux.
Conclusion
Fast flux turns DNS into a shield for criminal infrastructure, and IP blocking alone cannot keep up. Pair protective DNS with threat intelligence, choose DNS providers that support domain-level controls, and review the wider security risks for CDN operations.
FAQs
What Is the Difference Between Single-Flux and Double-Flux DNS?
Single flux rotates a domain's A records, so it points to a constantly changing set of IP addresses. Double flux also rotates the domain's name servers, so even the servers answering DNS queries keep moving. That leaves defenders no stable server to take down, which makes double flux much harder to disrupt.
Can a CDN Detect Fast Flux Traffic in Real Time?
Not on its own. Fast flux shows up at the DNS resolver, by comparing answers across repeated lookups, so a CDN delivering your content never sees those patterns. Providers that also run resolvers or secure web gateways can block known malicious domains quickly, but brand new domains need a short observation window.
How Does DNS TTL Length Relate to Fast Flux Evasion?
A short TTL forces resolvers to ask again after a minute or two, and each new answer can return fresh proxy IPs. Fast flux domains often use TTLs of a few minutes or less. TTL proves little on its own, though, because legitimate CDNs also use TTLs as short as 20 seconds.
Does Blocking Fast Flux Domains Affect Legitimate CDN Traffic?
Blocking the domain does not. Blocking IP addresses can, because CDN IPs are shared: in 2026, Spain's IP blocks against football piracy hit over 550,000 domains, mostly unrelated sites on Cloudflare, according to OONI. Good detection checks ownership, since CDN answers come from one provider's network while flux nodes span many ISPs.
What Role Does RPKI Play in DNS Attack Defense?
RPKI protects routing, not DNS records. It lets networks reject BGP announcements from unauthorized origins, the kind of BGP hijacking that redirected Amazon Route 53 traffic in 2018 to steal cryptocurrency. It only helps where networks enforce it, and DNSSEC is still needed to authenticate DNS answers.
