So we just had some conversation about it and it and in fact onion discovery works fine with SRV records. The problem is if you set the highest priority for an

So we just had some conversation about it and it and in fact onion discovery works fine with SRV records. The problem is if you set the highest priority for an onion, tor-unaware clients may try to make a DNS request for it, and i believe a bunch of resolvers are still happy to try and resolve onions despite rfc7686 special-casing .onion (back in 2015), which would result in metadata leak: your resolver would learn what onion addresses you tried to reach. Whether that's a huge concern or not is a good debate. In the case where the .onion is a security upgrade to the network connection for a "normal" vhost, then it's not a problem because your resolver has already learned about the vhost you'd like to reach (via the SRV query). The real problem would be if a client tried to resolve foobar.onion through DNS when provided with a user@foobar.onion login. According to spec DNS software should not do that, but from a super quick review it appears a number of DNS implementations still do that. I'm not sure what the best approach is here. But surely there's a solution to find.