It's better to whitelist the domains you'll be getting mfa from.