On another client, we use Sonicwalls (which we are happily replacing with pfsense in our new installation).  Sonicwall does have a couple of features that make this pretty easy.  It has the ability to create an address object (think Alias in pfsense) with a wildcarded name.  So I can create an alias called UPS which points to "*.ups.com" - and the sonicwall worries about any address resolution.

I can take this a step further by creating another Address Object (alias) that is a collection of other objects.  So after creating all of my allowed outgoing domains, I create a new object called "Permitted Outgoing Sites" and all of the individual go into it. I then create a single rule that has the destination of Permitted Outgoing sites and the various ports that are allowed - and just like that I'm done.  When we have a new vendor, I just add the alias, and add it to the parent record.

I know I could do most of this in pfsense with inidividual entries, but it becomes a maintenance nightmare (if ip addresses change, or the vendors increase the number of web servers, etc).

Am I missing something, or am I pretty much limited to creating the individual aliases?