Another reason to prefer _dnslink.domain: prevention of plausible future dns amplification attacks

[sixcorners]

A dns amplification attack is a way to multiply the amount of bytes you are sending to a denial of service target. If there are domains with large records on them an attacker can send requests for these records to be responded to the victim to amplify their attack.
I think the main concern right now are other types of records or responses like ANY or AXFR... but it could be in the future that if everyone put their TXT records directly on the domain root you could end up with some sites with giant dns responses.

I don't know if it is worth adding this to the faq about _dnslink.domain. https://dnslink.io/#why-use-dnslink-domain-instead-of-domain

https://blog.cloudflare.com/deep-inside-a-dns-amplification-ddos-attack/