Are you currently using IP address whitelisting for Rabobank Smart Pay?
Then you will need to ensure that all requests to your webhook URL are allowed.
For security, you can rely on signature verification.

If your system does not support API requests without using whitelisting, then use domain listing for the domain: out.pay.rabobank.nl
In this case, you will need to perform a dynamic DNS lookup on this domain to obtain the list of A records, and then allow these IP addresses to communicate with your webhook URL.

Please note that this list of A records may change at any time, without prior notice.
This is necessary so that we can continue to guarantee the continuity of our services.
You should therefore perform the DNS lookup on the domain regularly to keep the list of A records as up to date as possible.

As Rabobank indicates, these A records can change at any time without prior notice. It is therefore advisable to:

Do not rely exclusively on static IP whitelists.
Perform a DNS query on out.pay.rabobank.nl regularly.
If possible, automatically synchronize the DNS results with the IP addresses allowed in your webhook environment.