> Really? I didn’t realize there was a client-side problem there.

You'd need some new API for resolving a given host:service combination in a single request, which to the best of my knowledge does not exist today. With current APIs, you'd make one request to resolve the name and a separate request to resolve the service.

> I guess there’s still a security problem, though, if the SRV record points to a hostname that nameserver may not be authoritative for.

That seems like the same kind of issue that can occur today if you make a hostname you control point to an IP you don't. Both seem like similar problems with similar solutions.