SPF is not a security credential
I think the big misconception here is that SPF records provide a trusted credential. In truth SPF is not a secure credential, at least in the real world of security.
DNS is an inherently insecure protocol. It's based on UDP (no transport level handshake), the protocol itself does not implement a handshake, and there is no cryptographic guarantee that the "reply" packet you get hasn't been spoofed. If you do some research you can find this all over the place.
The elephant in the room is pretty obvious here: if DNS is so insecure, why is it okay for SPF to do what it does? Because the risk is low. The worst that can happen with SPF is a zero gain scenario: you're right back to where you were if you had no SPF record. SPF is an ugly compromise that mail admins were forced to reach in the face of a much larger problem, and that's the extent of it.
For further research, I recommend you look into a little-known DNS record type called SSHFP
and the challenges that it faces to be useful. SSHFP
is a standard for putting a server's SSH public key in DNS. Your SSH client would never ask you to initially trust a key. That'd be fantastic. But if you look into the prerequisites for a SSHFP
record to be trusted by a SSH client, it's exactly the same type of problem that is being described here. This should eliminate any remaining doubts about whether DNS can be used to supply security credentials without some form of root nameserver trust. (DNSSEC)
DNS security isn't the only challenge
Okay, so now you know why what you're describing hasn't been done before. DNSSEC is just around the corner though, right? Let's pretend for a moment that validating DNSSEC resolvers are available to everyone, and that DNSSEC doesn't face the same kind of inertia that IPv6 does.
This standard probably isn't going to happen.
I know comment thread accompanying Mark's answer isn't what you want to hear, but they've got the nail on the head when it comes to it being a bad idea to have a published list of trusted IPs. Big companies are going to be very dis-incentivized to implement a three step trust where you are publishing a list of IPs to the internet that can be used to access their system. It's an absurd prospect for them, particularly when public key cryptography exists and is the preferred way for managing systems of delegated trust.
In this answer I've mentioned two technologies that address much bigger problems that impact everyone in IT on a global scale, both of which face significant inertia. That inertia is gonna be nothing compared to getting this bird to fly. That's the damn truth.