diff --git a/openbsc/src/gprs/gprs_gmm.c b/openbsc/src/gprs/gprs_gmm.c
index d7ba5b4..07fd1dc 100644
--- a/openbsc/src/gprs/gprs_gmm.c
+++ b/openbsc/src/gprs/gprs_gmm.c
@@ -29,6 +29,7 @@
 
 #include <netinet/in.h>
 #include <arpa/inet.h>
+#include <netdb.h>
 
 #include <openbsc/db.h>
 #include <osmocom/core/msgb.h>
@@ -37,6 +38,7 @@
 #include <osmocom/core/signal.h>
 #include <osmocom/core/talloc.h>
 #include <osmocom/core/rate_ctr.h>
+#include <osmocom/gsm/apn.h>
 
 #include <osmocom/gprs/gprs_bssgp.h>
 
@@ -1633,7 +1635,7 @@
 static int activate_ggsn(struct sgsn_mm_ctx *mmctx,
 		struct sgsn_ggsn_ctx *ggsn, const uint8_t transaction_id,
 		const uint8_t req_nsapi, const uint8_t req_llc_sapi,
-		struct tlv_parsed *tp)
+		struct tlv_parsed *tp, int destroy_ggsn)
 {
 	struct sgsn_pdp_ctx *pdp;
 
@@ -1646,10 +1648,94 @@
 	/* Store SAPI and Transaction Identifier */
 	pdp->sapi = req_llc_sapi;
 	pdp->ti = transaction_id;
+	pdp->destroy_ggsn = destroy_ggsn;
 
 	return 0;
 }
 
+static void ggsn_lookup_cb(void *arg, int status, int timeouts, struct hostent *hostent)
+{
+	struct sgsn_ggsn_ctx *ggsn;
+	struct sgsn_ggsn_lookup *lookup = arg;
+	struct in_addr *addr = NULL;
+	int i;
+
+	/* The context is gone while we made a request */
+	if (!lookup->mmctx) {
+		talloc_free(lookup);
+		return;
+	}
+
+	if (status != ARES_SUCCESS) {
+		struct sgsn_mm_ctx *mmctx = lookup->mmctx;
+
+		LOGMMCTXP(LOGL_ERROR, mmctx, "DNS query failed.\n");
+
+		/* Need to try with three digits now */
+		if (lookup->state == SGSN_GGSN_2DIGIT) {
+			char *hostname;
+			int rc;
+
+			lookup->state = SGSN_GGSN_3DIGIT;
+			hostname = osmo_apn_qualify_from_imsi(mmctx->imsi,
+					lookup->apn_str, 1);
+			LOGMMCTXP(LOGL_DEBUG, mmctx,
+				"Going to query %s\n", hostname);
+			rc = sgsn_ares_query(sgsn, hostname,
+					ggsn_lookup_cb, lookup);
+			if (rc != 0) {
+				LOGP(DGPRS, LOGL_ERROR, "Couldn't start GGSN\n");
+				goto reject_due_failure;
+			}
+			return;
+		}
+
+		LOGMMCTXP(LOGL_ERROR, mmctx, "Couldn't resolve GGSN\n");
+		goto reject_due_failure;
+	}
+
+	if (hostent->h_length != sizeof(struct in_addr)) {
+		LOGMMCTXP(LOGL_ERROR, lookup->mmctx,
+			"Wrong addr size(%d)\n", sizeof(struct in_addr));
+		goto reject_due_failure;
+	}
+
+	/* get the address */
+	for (i = 0, addr = (struct in_addr *) hostent->h_addr_list[i]; addr;
+		i++, addr = (struct in_addr *) hostent->h_addr_list[i]) {
+		break;
+	}
+
+	if (!addr) {
+		LOGMMCTXP(LOGL_ERROR, lookup->mmctx, "No host address.\n");
+		goto reject_due_failure;
+	}
+
+	ggsn = sgsn_ggsn_ctx_alloc(UINT32_MAX);
+	if (!ggsn) {
+		LOGMMCTXP(LOGL_ERROR, lookup->mmctx, "Failed to create ggsn.\n");
+		goto reject_due_failure;
+	}
+	ggsn->remote_addr = *addr;
+	LOGMMCTXP(LOGL_NOTICE, lookup->mmctx,
+		"Selected %s as GGSN.\n", inet_ntoa(*addr));
+
+	/* forget about the ggsn look-up */
+	lookup->mmctx->ggsn_lookup = NULL;
+
+	activate_ggsn(lookup->mmctx, ggsn, lookup->ti, lookup->nsapi,
+			lookup->sapi, &lookup->tp, 1);
+
+	/* Now free it */
+	talloc_free(lookup);
+	return;
+
+reject_due_failure:
+	gsm48_tx_gsm_act_pdp_rej(lookup->mmctx, lookup->ti,
+				GMM_CAUSE_NET_FAIL, 0, NULL);
+	lookup->mmctx->ggsn_lookup = NULL;
+	talloc_free(lookup);
+}
 
 static int do_act_pdp_req(struct sgsn_mm_ctx *mmctx, struct msgb *msg)
 {
@@ -1662,6 +1748,9 @@
 	struct sgsn_ggsn_ctx *ggsn;
 	struct sgsn_pdp_ctx *pdp;
 	enum gsm48_gsm_cause gsm_cause;
+	char apn_str[GSM_APN_LENGTH] = { 0, };
+	char *hostname;
+	int rc;
 
 	LOGMMCTXP(LOGL_INFO, mmctx, "-> ACTIVATE PDP CONTEXT REQ: SAPI=%u NSAPI=%u ",
 		act_req->req_llc_sapi, act_req->req_nsapi);
@@ -1746,22 +1835,64 @@
 						0, NULL);
 	}
 
+	if (mmctx->ggsn_lookup) {
+		if (mmctx->ggsn_lookup->sapi == act_req->req_llc_sapi &&
+			mmctx->ggsn_lookup->ti == transaction_id) {
+			LOGMMCTXP(LOGL_NOTICE, mmctx,
+				"Re-transmission while doing look-up. Ignoring.\n");
+			return 0;
+		}
+	}
+
 	/* Only increment counter for a real activation, after we checked
 	 * for re-transmissions */
 	rate_ctr_inc(&mmctx->ctrg->ctr[GMM_CTR_PDP_CTX_ACT]);
 
 	/* Determine GGSN based on APN and subscription options */
-	ggsn = sgsn_mm_ctx_find_ggsn_ctx(mmctx, &tp, &gsm_cause);
-	if (!ggsn) {
-		LOGP(DGPRS, LOGL_ERROR, "No GGSN context found!\n");
-		return gsm48_tx_gsm_act_pdp_rej(mmctx, transaction_id,
-						gsm_cause, 0, NULL);
+	ggsn = sgsn_mm_ctx_find_ggsn_ctx(mmctx, &tp, &gsm_cause, apn_str);
+	if (ggsn)
+		return activate_ggsn(mmctx, ggsn, transaction_id,
+				act_req->req_nsapi, act_req->req_llc_sapi,
+				&tp, 0);
+
+	if (strlen(apn_str) == 0)
+		goto no_context;
+	if (!sgsn->cfg.dynamic_lookup)
+		goto no_context;
+
+	/* schedule a dynamic look-up */
+	mmctx->ggsn_lookup = talloc_zero(tall_bsc_ctx, struct sgsn_ggsn_lookup);
+	if (!mmctx->ggsn_lookup)
+		goto no_context;
+
+	mmctx->ggsn_lookup->state = SGSN_GGSN_2DIGIT;
+	mmctx->ggsn_lookup->mmctx = mmctx;
+	strcpy(mmctx->ggsn_lookup->apn_str, apn_str);
+
+	mmctx->ggsn_lookup->orig_msg = msg;
+	mmctx->ggsn_lookup->tp = tp;
+
+	mmctx->ggsn_lookup->ti = transaction_id;
+	mmctx->ggsn_lookup->nsapi = act_req->req_nsapi;
+	mmctx->ggsn_lookup->sapi = act_req->req_llc_sapi;
+
+	hostname = osmo_apn_qualify_from_imsi(mmctx->imsi,
+				mmctx->ggsn_lookup->apn_str, 0);
+
+	LOGMMCTXP(LOGL_DEBUG, mmctx, "Going to query %s\n", hostname);
+	rc = sgsn_ares_query(sgsn, hostname,
+				ggsn_lookup_cb, mmctx->ggsn_lookup);
+	if (rc != 0) {
+		LOGMMCTXP(LOGL_ERROR, mmctx, "Failed to start ares query.\n");
+		goto no_context;
 	}
 
-	/* Now activate the GGSN */
-	return activate_ggsn(mmctx, ggsn, transaction_id,
-				act_req->req_nsapi, act_req->req_llc_sapi,
-				&tp);
+	return 0;
+
+no_context:
+	LOGP(DGPRS, LOGL_ERROR, "No GGSN context found!\n");
+	return gsm48_tx_gsm_act_pdp_rej(mmctx, transaction_id,
+					gsm_cause, 0, NULL);
 }
 
 /* Section 9.5.1: Activate PDP Context Request */
diff --git a/openbsc/src/gprs/gprs_sgsn.c b/openbsc/src/gprs/gprs_sgsn.c
index 3c25840..cc1ae4d 100644
--- a/openbsc/src/gprs/gprs_sgsn.c
+++ b/openbsc/src/gprs/gprs_sgsn.c
@@ -207,6 +207,14 @@
 	struct sgsn_pdp_ctx *pdp, *pdp2;
 	struct sgsn_signal_data sig_data;
 
+	/* Forget about ongoing look-ups */
+	if (mm->ggsn_lookup) {
+		LOGMMCTXP(LOGL_NOTICE, mm,
+			"Cleaning mmctx with on-going query.\n");
+		mm->ggsn_lookup->mmctx = NULL;
+		mm->ggsn_lookup = NULL;
+	}
+
 	/* delete all existing PDP contexts for this MS */
 	llist_for_each_entry_safe(pdp, pdp2, &mm->pdp_list, list) {
 		LOGMMCTXP(LOGL_NOTICE, mm,
@@ -349,6 +357,8 @@
 		lib->priv = NULL;
 	}
 
+	if (pdp->destroy_ggsn)
+		sgsn_ggsn_ctx_free(pdp->ggsn);
 	talloc_free(pdp);
 }
 
@@ -614,7 +624,8 @@
  */
 struct sgsn_ggsn_ctx *sgsn_mm_ctx_find_ggsn_ctx(struct sgsn_mm_ctx *mmctx,
 						struct tlv_parsed *tp,
-						enum gsm48_gsm_cause *gsm_cause)
+						enum gsm48_gsm_cause *gsm_cause,
+						char *out_apn_str)
 {
 	char req_apn_str[GSM_APN_LENGTH] = {0};
 	const struct apn_ctx *apn_ctx = NULL;
@@ -623,6 +634,8 @@
 	struct sgsn_ggsn_ctx *ggsn = NULL;
 	int allow_any_apn = 0;
 
+	out_apn_str[0] = '\0';
+
 	if (TLVP_PRESENT(tp, GSM48_IE_GSM_APN)) {
 		if (TLVP_LEN(tp, GSM48_IE_GSM_APN) >= GSM_APN_LENGTH - 1) {
 			LOGMMCTXP(LOGL_ERROR, mmctx, "APN IE too long\n");
@@ -695,6 +708,9 @@
 		return NULL;
 	}
 
+	/* copy the selected apn_str */
+	strcpy(out_apn_str, selected_apn_str);
+
 	if (apn_ctx == NULL && selected_apn_str)
 		apn_ctx = sgsn_apn_ctx_match(selected_apn_str, mmctx->imsi);
 
diff --git a/openbsc/src/gprs/sgsn_main.c b/openbsc/src/gprs/sgsn_main.c
index d5f7f65..8cb7499 100644
--- a/openbsc/src/gprs/sgsn_main.c
+++ b/openbsc/src/gprs/sgsn_main.c
@@ -378,6 +378,14 @@
 		exit(2);
 	}
 
+	if (sgsn->cfg.dynamic_lookup) {
+		if (sgsn_ares_init(sgsn) != 0) {
+			LOGP(DGPRS, LOGL_FATAL,
+				"Failed to initialize c-ares(%d)\n", rc);
+			exit(4);
+		}
+	}
+
 	if (daemonize) {
 		rc = osmo_daemonize();
 		if (rc < 0) {
diff --git a/openbsc/src/gprs/sgsn_vty.c b/openbsc/src/gprs/sgsn_vty.c
index b7023ad..65b5a39 100644
--- a/openbsc/src/gprs/sgsn_vty.c
+++ b/openbsc/src/gprs/sgsn_vty.c
@@ -135,12 +135,18 @@
 		inet_ntoa(g_cfg->gtp_listenaddr.sin_addr), VTY_NEWLINE);
 
 	llist_for_each_entry(gctx, &sgsn_ggsn_ctxts, list) {
+		if (gctx->id == UINT32_MAX)
+			continue;
+
 		vty_out(vty, " ggsn %u remote-ip %s%s", gctx->id,
 			inet_ntoa(gctx->remote_addr), VTY_NEWLINE);
 		vty_out(vty, " ggsn %u gtp-version %u%s", gctx->id,
 			gctx->gtp_version, VTY_NEWLINE);
 	}
 
+	if (sgsn->cfg.dynamic_lookup)
+		vty_out(vty, " ggsn dynamic%s", VTY_NEWLINE);
+
 	vty_out(vty, " auth-policy %s%s",
 		get_value_string(sgsn_auth_pol_strs, g_cfg->auth_policy),
 		VTY_NEWLINE);
@@ -236,6 +242,14 @@
 	return CMD_SUCCESS;
 }
 
+DEFUN(cfg_ggsn_dynamic_lookup, cfg_ggsn_dynamic_lookup_cmd,
+	"ggsn dynamic",
+	GGSN_STR "Enable dynamic GRX based look-up (requires restart)\n")
+{
+	sgsn->cfg.dynamic_lookup = 1;
+	return CMD_SUCCESS;
+}
+
 #define APN_STR	"Configure the information per APN\n"
 #define APN_GW_STR "The APN gateway name optionally prefixed by '*' (wildcard)\n"
 
@@ -878,6 +892,7 @@
 	install_element(SGSN_NODE, &cfg_cdr_filename_cmd);
 	install_element(SGSN_NODE, &cfg_no_cdr_filename_cmd);
 	install_element(SGSN_NODE, &cfg_cdr_interval_cmd);
+	install_element(SGSN_NODE, &cfg_ggsn_dynamic_lookup_cmd);
 
 	return 0;
 }