In our production environment, we are connecting to a few core external service providers though their APIs, and are required to have all other services blocked (PCI DSS).
We currently have a firewall which supports egress filtering by ip address so all non-essential addresses are blocked based on statically-created firewall rules (deny all, allow 220.127.116.11:443 etc)
So far all is good, now here is the problem, one of our service providers (a big bank) is moving to an edge/cdn hosted API for one of it's services and the ip of the services IS going to change several times per day.
I have read other articles about egress filtering: Firewall egress filtering / quick whitelisting
...as well as possibly using scripts to modify an iptables based firewall based on a DNS query. https://stackoverflow.com/questions/14096966/can-iptables-allow-dns-queries-only-for-a-certain-domain-name
...but these solutions seem hacky
Are there firewalls we can use that have domain based rules, instead of IP based so our API requests continue to arrive un-interrupted yet we continue to block all other outbound connections?