Limit WebServices access to two domains

How do I limit access to one Web Service to only two domains?

I would like only the domain: http://"ServidoX".ipesp.gov" and http://"ServidoY".ipesp.gov" to consume this service.

I have tried to modify in Web.Config using the Tag:

add name="Access-Control-Allow-Origin" value="http://"XXXXX".ipesp.gov,   http://"YYYY.ipesp.gov"

Currently the Web.Config file is configured like this:

add name="Access-Control-Allow-Origin" value="*"

I also tried restricting access to the application on IIS Server, but it did not work.