Initial official claims that the bomber was a lone woman have been replaced by uncertainty about who carried it out.
President Vladimir Putin has ordered security to be tightened at railway stations and airports across Russia.
Moscow is concerned militant groups could be ramping up violence in the run-up to the 2014 winter Olympic Games in the city of Sochi in six weeks.
The Olympic venue is close to Russia's volatile north Caucasus region.
By Daniel SandfordBBC News, Moscow
In June, Doku Umarov, one of the leaders of the Islamist insurgency in the Russian Caucasus republics, called on his supporters to use "maximum force" to disrupt the "satanic" winter Olympics in Sochi.
It is too early to say whether the attack in Volgograd was by one of his supporters.
But it shows that - despite the metal detectors at railway stations, airports and shopping centres in Russia - bombers are still able to kill and wreak havoc.
It also shows that the attacks will not have to be on Sochi itself to attract attention.
Sunday's explosion rocked Volgograd-1 station at around 12:45 (08:45 GMT) at a time of year when millions of Russians are travelling to celebrate the New Year.
A nearby security camera facing the station caught the moment of the blast, showing a bright orange flash behind the station's main doors.
The explosion shattered windows and sent debris and plumes of smoke from the station entrance.
The first cameras on the scene showed bodies lying outside, and inside, twisted metal and singed, pock-marked walls.
Motionless bodies were laid out in the station forecourt while ambulances rushed those hurt to hospital. About 40 people are said to have been injured, including a nine-year-old girl whose mother was killed in the attack.
"People were lying on the ground, screaming and calling for help," a witness, Alexander Koblyakov, told Rossiya-24 TV.
"I helped carry out a police officer whose head and face were covered in blood. He couldn't speak."
President Putin ordered law enforcement agencies to take "all necessary security measures" in the bomb's aftermath, said a Kremlin spokesman.
He ordered the most gravely injured victims to be flown to Moscow for treatment.
Security will be stepped up at railway stations and airports.
No group has yet claimed responsibility for the blast, but a spokesman for Russia's Investigative Committee, Vladimir Markin, said the incident was being treated as an act of terrorism.
An Islamist insurgency in the North Caucasus region has led to many attacks there in recent years. Insurgents have also attacked big Russian towns.
This attack shows that the bombers do not need to attack Sochi directly to attract international attention - any target in Russia will do, says the BBC's Daniel Sandford in Moscow.
Volgograd lies about 900km (560 miles) south of Moscow, 650km north of the North Caucasus and 700km north-east of Sochi.
The bomb used in the attack contained 10 kg (22 pounds) of TNT, was rigged with shrapnel and was detonated near the metal detectors at the station entrance, Mr Markin said.
He said that initial information suggested the bomber "approached a metal detector, saw a policeman there, got nervous and detonated the bomb stuffed with pieces of shrapnel".
He said the security presence had prevented a much higher death toll at the station, which was packed at the time of the blast as several trains were delayed.
Mr Markin was among officials suggesting early on that the bomber was a woman - with RIA Novosti news agency naming the attacker as a Dagestani woman, Oksana Aslanova, and other new outlets publishing pictures of what they said was the severed head of the female bomber.
But investigators' initial certainty was replaced with uncertainty, with suggestions the bomber could have been a man or that there could have been multiple bombers, our correspondent says.
In July, Chechen insurgent leader Doku Umarov posted an online video urging militants to use "maximum force" to prevent the Games from going ahead.
A suspected female suicide bomber killed at least six people when she attacked a bus in Volgograd in October.
On Friday, a car bomb killed three people in the southern Russian city of Pyatigorsk.
A suicide attack on a train station in Russia's southern city of Volgograd has killed 16 people, officials say.