Not a DNS record, no one uses dnssec so DNS is insecure. A .well-known path, with a TLS cert is better. Or a special subdomain, like MTA-STS uses.