I could understand verifying domain names, but verifying IP addresses seems like it would be an extremely complex feature for very little benefit. You'd have t

I could understand verifying domain names, but verifying IP addresses seems like it would be an extremely complex feature for very little benefit. You'd have to have implement it in-line with the dns resolution in the server before talking to the origin, right? There's no other time you could reasonably do it (DNS changes), and it would have to be checked on all customers requests, not just the ones that opted into the feature (because those other customers could be the "attacker"!). Of course, you would cache it and use an efficient lookup scheme, but in general cloud services really don't like creating features that have non-localized effects like this. Not to mention this sounds like a support nightmare foot gun for enterprise customers.