I'm generally interested in Bluesky (and I'm already using it), but I think DNS was probably the wrong choice for them here: it's not authenticated (and can't easily be authenticated in reasonable ways), and has relatively weak guarantees around propagation, invalidation, etc.
The "well-known" URI scheme[1] was intended to overcome many of these deficiencies, and has worked admirably in other contexts (for example, Let's Encrypt's HTTP-01 challenge scheme[2]). I believe Bluesky also supports a "well-known" flow for domain verification, but it seems like it still isn't the default.