A dns name may be mapped to multiple IPs (case 1). Same IP could be mapped to multiple dns names (case 2). So, if you're blocking an IP, you might end up block

A dns name may be mapped to multiple IPs (case 1). Same IP could be mapped to multiple dns names (case 2). So, if you're blocking an IP, you might end up blocking multiple domains (case 2) or end up not even effectively blocking a single domain (case 1). This confuses users, and you get reports like: 1. I blocked a Google IP but my app still connects to google.com (case 1, since Google owns a gazillion IPs). 2. I blocked a cloudflare.com IP and now can't access reactjs.org (case 2, where IPs are shared). Some folks find it easier to reason about rules on domain names than IPs. So, blocking/allowing domain names makes for a better user experience, when implemented right.