Agree in one sense, and yes, this could be pushback on the requirements.  But what he doesn’t do is distinguish between what is actually collected and what is accessed - by whom and in what circumstances.  For what is collected, yes, the data minimisation principle will apply. But that necessarily includes contact information, for legitimate purposes in just managing the DNS. It is who accesses and under what circumstances that is the issue.  And in that regard, please read Scott’s latest email on the viability of controlling access by authenticated/certified parties.

Happy reading

Holly