It seems to me that an IP address white list relies on easily spoofed information, while a domain white list, if it forces TLS, at least, relies on the validity of the certificate systems.
I may be framing this question incorrectly, or comparing apples and oranges here, but I still think what I'm trying to get at has a specific answer.
This seems related to the following two questions I came across on this site:
How should an outgoing connection white-list be created? <<< This could be a duplicate, but I think what I'm trying to get at is a bit more specific to auto-scaling the corporate security policy enforcement.
Business units, customers, colleagues, etc. keep asking about IP addresses for security purposes when certified, TLS-enabled domains, sometimes even internally, are available already.
Maybe there's no difference, but I feel like something's wrong, here with the "please send us the IP ranges" approach.
I've seen this get in the way of everything from phone calls to continuous deployment to trying to use GitHub, so I want to know:
IP address filtering vs. TLS domain filtering: Is there an increase in security?