Domain churn is the rapid creation, replacement, or rotation of domains within a short period. Threat actors use it to avoid reputation-based blocking, spread traffic across many names, and make tracking harder for defenders. In DNS telemetry, churn often appears as a sudden rise in unique domains, short-lived registrations, or repeated lookups that shift from one host to another.
This matters because DNS is easy to normalize at scale: a single domain can blend into routine traffic until the pattern changes. Defenders watch for churn to spot tunneling, phishing infrastructure, malware command-and-control, and relay systems that constantly move between domains. Security tools may respond with enrichment, correlation across passive DNS, and blocking rules that focus on behavior rather than one name. The key lesson is that frequent domain changes are often a tactic, not noise.