 Although it is additionally possible to configure access-control lists based on network domain names, this is a questionable idea because individual TCP, UDP, and ICMP headers do not contain domain names.Consequently, the device enforcing the access-control list must separately resolve names to numeric addresses.This presents an additional attack surface for an attacker who is seeking to compromise security of the system which the access-control list is protecting.