ASA FQDN access lists
At the time of this post, I had limited exposure to ASA 9.2 code and particularly using FQDN access-lists.
Essentially what you can do is create an object with the Fully Defined Domain Name (FQDN) of a domain nested within. You can create multiple of these and place them inside a single object-group to keep things tidy (and you should!).
As the hosts hit the ASA, the ASA will do a DNS lookup with the FQDN hosts listed within your object’s and permit traffic from only that A record/CNAME inbound. This can be used to allow access to cloud services which change their A records often.
Below is visual example showing the DNS query performed by the ASA, and the access-list showing hits on the fqdn.
ASA# show access-list inside_in access-list inside_in; 4 elements; name hash: 0xd3a8690b access-list inside_in line 1 deny ip any object obj-hr88.cisco.com access-list inside_in line 1 deny ip any fqdn hr88.cisco.com (resolved) access-list inside_in line 1 deny ip any host 10.32.2.4 (hr88.cisco.com) (hitcnt=10) access-list inside_in line 1 deny ip any host 10.32.2.3 (hr88.cisco.com) (hitcnt=35) access-list inside_in line 2 permit ip any any (hitcnt=12022)
Have a read more in the below article for some further insight; Pretty cool stuff!