Correct names for subdomain DNS proof records

There seems to be varying information on what the hostname for a TXT record should be. For example, given _site.domain.com_, I have seen the following options:
- `@` (keybase.io proof flow, GitHub issues)
- `_keybase` (GitHub issues)
- `site` (CLI, keybase.io sig page)
- `_keybase.site` (CLI, keybase.io sig page)

Only the last of these worked for me (I've tried all combinations with 5 minute TTLs and waiting a few hours for propagation -- `_keybase.site` verified after a few minutes). I have an SPF record on `@`, which I guess from other issues can be problematic.

Which of these are correct? I'm assuming the latter two (or the first two if proving ownership of _example.com_). It would perhaps be useful for the proof flow to detect subdomains and suggest using a host name matching it, rather than always giving `@`.

The issue references the proof flow, CLI, keybase.io signature page, and GitHub issue guidance; compare their TXT hostnames for root and subdomain proofs. Confirm the correct hostname, including the stated SPF interaction, and define the expected subdomain suggestion. Done means the guidance and proof flow agree for the cases described.

Written by the indexing model from the issue text.