As such, DNS could be used as a transport mechanism with reasonably chosen TTLs.
sa-update already uses DNS to check for new updates. The record provides the latest version of the update rule set. The actual rules are downloaded by HTTP (in 2 steps, first downloading a mirror list, then from one of the available mirrors), but only when a change in version is detected.
