So I learned about SSHFP records at FUDCon and decided to implement them for some of our externally facing sites like cvs.fedoraproject.org, fedorapeople.org and git.fedorahosted.org (and others).
What is an SSHFP record? It's a ssh host key in DNS so you can verify it is correct. For example you can run:
$ dig SSHFP git.fedorahosted.org
Which will get you:
git.fedorahosted.org. 85975 IN SSHFP 2 1 DE382873ABE19B40AEFE714D686E15E16EAD5177
git.fedorahosted.org. 85975 IN SSHFP 1 1 A843ECED826C2F0075888150E89AE4567CD37D7F
So how can you use this information? Set VerifyHostKeyDNS to yes in your ssh_config (man ssh_config for more info, but you'll probably want to place it in your ~/.ssh/config file)
What is an SSHFP record? It's a ssh host key in DNS so you can verify it is correct. For example you can run:
$ dig SSHFP git.fedorahosted.org
Which will get you:
git.fedorahosted.org. 85975 IN SSHFP 2 1 DE382873ABE19B40AEFE714D686E15E16EAD5177
git.fedorahosted.org. 85975 IN SSHFP 1 1 A843ECED826C2F0075888150E89AE4567CD37D7F
So how can you use this information? Set VerifyHostKeyDNS to yes in your ssh_config (man ssh_config for more info, but you'll probably want to place it in your ~/.ssh/config file)

Comments
http://web.monkeysphere.info/
http://tools.ietf.org/html/rfc4255
[quote 4. Security Considerations]
The overall security of using SSHFP for SSH host key verification is
dependent on the security policies of the SSH host administrator and
DNS zone administrator (in transferring the fingerprint), detailed
aspects of how verification is done in the SSH implementation, and in
the client's diligence in accessing the DNS in a secure manner.
[/quote]
https://admin.fedoraproject.org/fingerp
Admittedly this is a manual verification process, but the data source itself can be trusted assuming the webserver has a suitably signed certificate. If you do not use DNSSEC, then to use SSHFP is to replace a secure, manual process with an insecure, automated process. This does not seem like a win to me.
Also, we have dnssec configured but not completely setup yet.
It doesn't take any options, but it *DOES* look in your configs to try to find all your known_hosts files (via the GlobalKnownHostsFile option) and it does seem to display information about known_hosts entries that "sshfp" didn't seem to.
Sean