6 files changed, 10 insertions, 8 deletions
diff --git a/src/lib/protocols/dns.c b/src/lib/protocols/dns.c
index ecf283a77..e12ece12c 100644
--- a/src/lib/protocols/dns.c
+++ b/src/lib/protocols/dns.c
@@ -529,8 +529,6 @@ static void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, st
     if(j > 0) {
       ndpi_protocol_match_result ret_match;
 
-      ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1);
-
       ret.app_protocol = ndpi_match_host_subprotocol(ndpi_struct, flow,
 						     flow->host_server_name,
 						     strlen(flow->host_server_name),
@@ -544,6 +542,8 @@ static void ndpi_search_dns(struct ndpi_detection_module_struct *ndpi_struct, st
 	ret.master_protocol = checkDNSSubprotocol(s_port, d_port);
       else
 	ret.master_protocol = NDPI_PROTOCOL_DNS;
+
+      ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1, 0);
     }
 
     /* Report if this is a DNS query or reply */
diff --git a/src/lib/protocols/fastcgi.c b/src/lib/protocols/fastcgi.c
index 9fad2c044..f70bd6cf5 100644
--- a/src/lib/protocols/fastcgi.c
+++ b/src/lib/protocols/fastcgi.c
@@ -212,7 +212,7 @@ void ndpi_search_fastcgi(struct ndpi_detection_module_struct *ndpi_struct,
                                   strlen(flow->host_server_name),
                                   &ret_match, NDPI_PROTOCOL_FASTCGI);
       ndpi_check_dga_name(ndpi_struct, flow,
-                          flow->host_server_name, 1);
+                          flow->host_server_name, 1, 0);
       if(ndpi_is_valid_hostname(flow->host_server_name,
                                 strlen(flow->host_server_name)) == 0) {
         char str[128];
diff --git a/src/lib/protocols/http.c b/src/lib/protocols/http.c
index 6fe6cab33..f9d6abd90 100644
--- a/src/lib/protocols/http.c
+++ b/src/lib/protocols/http.c
@@ -722,8 +722,6 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
     ndpi_hostname_sni_set(flow, packet->host_line.ptr, packet->host_line.len);
 
     if(strlen(flow->host_server_name) > 0) {
-      ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1);
-
       if(ndpi_is_valid_hostname(flow->host_server_name,
 				strlen(flow->host_server_name)) == 0) {
 	char str[128];
@@ -749,6 +747,10 @@ static void check_content_type_and_change_protocol(struct ndpi_detection_module_
 
     ndpi_http_parse_subprotocol(ndpi_struct, flow);
 
+    if(strlen(flow->host_server_name) > 0) {
+      ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1, 0);
+    }
+
     /**
        check result of host subprotocol detection
 
diff --git a/src/lib/protocols/netbios.c b/src/lib/protocols/netbios.c
index 710f18a71..45119ecbf 100644
--- a/src/lib/protocols/netbios.c
+++ b/src/lib/protocols/netbios.c
@@ -104,7 +104,7 @@ static void ndpi_int_netbios_add_connection(struct ndpi_detection_module_struct
 		 (u_int)(packet->payload_packet_len - off), name, sizeof(name)-1) > 0) {
       ndpi_hostname_sni_set(flow, (const u_int8_t *)name, strlen((char *)name));
 
-      ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1);
+      ndpi_check_dga_name(ndpi_struct, flow, flow->host_server_name, 1, 1);
   }
 
   if(sub_protocol == NDPI_PROTOCOL_UNKNOWN)
diff --git a/src/lib/protocols/quic.c b/src/lib/protocols/quic.c
index af43bf7e5..7889dad4d 100644
--- a/src/lib/protocols/quic.c
+++ b/src/lib/protocols/quic.c
@@ -1391,7 +1391,7 @@ static void process_chlo(struct ndpi_detection_module_struct *ndpi_struct,
       flow->protos.tls_quic.hello_processed = 1; /* Allow matching of custom categories */
 
       ndpi_check_dga_name(ndpi_struct, flow,
-                          flow->host_server_name, 1);
+                          flow->host_server_name, 1, 0);
 
       if(ndpi_is_valid_hostname(flow->host_server_name,
 				strlen(flow->host_server_name)) == 0) {
diff --git a/src/lib/protocols/tls.c b/src/lib/protocols/tls.c
index 98a8d8208..fe36555ed 100644
--- a/src/lib/protocols/tls.c
+++ b/src/lib/protocols/tls.c
@@ -1923,7 +1923,7 @@ int processClientServerHello(struct ndpi_detection_module_struct *ndpi_struct,
 		    }
 
 		    if(ndpi_check_dga_name(ndpi_struct, flow,
-					   sni, 1)) {
+					   sni, 1, 0)) {
 #ifdef DEBUG_TLS
 		      printf("[TLS] SNI: (DGA) [%s]\n", sni);
 #endif