Using a TXT record for this purpose would achieve nothing. Just like an SSLStrip attack would strip https:// https:// links and redirects, an attacker can simpl

Using a TXT record for this purpose would achieve nothing. Just like an SSLStrip attack would strip https:// https:// links and redirects, an attacker can simply block or spoof the DNS response. This doesn't add anything that you don't get with regular header-based HSTS. DNSSEC has no practical impact on this due to a lack of adoption both on the domain and end-user resolver side. (Not to mention that it's a terrible protocol.) Note that the HSTS preload list is not only used by Chrome, but practically all major browsers. For all intents and purposes it currently is the central source of truth. I imagine if the size ever becomes a problem, browsers will switch to a mechanism like Safe Browsing to distribute the list.