All that happens if a spammer validates pubkeys on their domain is that their entire domain gets permanently blocked. How fast can they spin up new domains? Not very. We win. NIP-05 is still useful for spam prevention.