lemmy.ml is hosted in EU, and lemmynsfw.com uses CloudFlare, which operates in EU. Worst case, issue a GDPR request to both.

I’m surprised federation isn’t based on asymmetric cryptography. Let the public/private keys identify instances, as opposed to domains that risk being blocked by governments or bought by malicious third parties if the instance owner forgets to prolong it.

With that, implementing a change in domain names would be simple.

Indeed. Most of the web is broken under GDPR’s privacy requirements.

GDPR believes an IP address is a private information. This can be used to mount a legal attack on EU-hosted lemmy instances.