Whitelisting doesn't work if one doesn't know the email domain name the service will use.

An Amazon verification email will be sent from "account-update@amazon.com". It's intuitive to predict "@amazon.com" so whitelisting works.

However, State Farm Insurance login verification codes are actually sent from "noreply@sfauthentication.com" instead of the "@statefarm.com"