Ontario's Buy Ontario Procurement Directive has been in force since April 13. It tells public-sector organizations to prioritize Ontario and Canadian goods and services. We wanted to know whether that thinking reaches the technology that runs the government, so we did what anyone can do: looked up the A, MX and NS records for 12 provincial government and agency domains.
Obvious disclosure, since this is our sub: we host email in Canada, so we would benefit if Ontario acted on any of this. The article says so in its second paragraph, and the numbers below come from public records you can verify with our DNS lookup tool or any other.
What the records show
- 11 of 11 domains that publish an MX record send inbound email through a US-owned provider. 8 are Microsoft 365; the rest are Namecheap, Amazon and Proofpoint.
- 10 of 12 websites sit on foreign-owned infrastructure. ServiceOntario is the standout exception: its own network, its own DNS, its own backup mail relay.
- 7 of 12 keep authoritative DNS under Canadian control. Ontario runs its own nameservers for ontario.ca, which deserves credit.
- SupportOntarioMade.ca, the program that promotes Ontario-made products, runs its email on Namecheap Private Email, which Namecheap documents as hosted in Phoenix.
- Destination Ontario's inbound mail goes to AWS us-east-1. Infrastructure Ontario's apex address is in an address block registered to Episerver's Stockholm hosting network.
What we were careful not to claim
IP geolocation is unreliable for CDN and anycast addresses, so the article names the registered owner of each address block, not a city. The only city-level claim is Stockholm, where the RIPE registration itself names the location. The bare ontario.ca address in Virginia is a redirect server, not the website.
Why a Toronto data centre is only half an answer
Microsoft, Amazon and Google all have Canadian regions. That settles where the data sits. It does not settle whose law governs it: the US CLOUD Act lets US legal process compel a US-headquartered provider to produce data it holds anywhere, Canada included. In June 2025 Microsoft France's director of public and legal affairs was asked by a French Senate committee, under oath, whether he could guarantee French data would never be handed to US authorities without French consent. His answer was that he could not.
The case for the status quo
We wrote it in, because it is real: centrally negotiated enterprise agreements, the certifications procurement asks for, Entra ID as the identity layer everything else hangs off, tens of thousands of staff trained on Outlook and Teams, and the fair question of whether any Canadian vendor, us included, has run mailboxes at Ontario Public Service scale. We are not aware of one that has. That is why the article asks for a pilot, not a rip-and-replace.
What others are doing
Switzerland is putting roughly 3,000 federal employees on an open-source workplace from the end of 2027, in parallel with Microsoft 365. France is moving government workstations from Windows to Linux. Schleswig-Holstein had almost 44,000 mailboxes on Open-Xchange by December 2025. And Munich, the story everyone cites as the failure, is not the failure story it is usually told as; the article goes through what the Accenture review actually found and what the city's 2020 and 2026 coalition agreements have since done.
Full article, with the table of all 12 domains, methodology and sources: https://www.thexyz.com/blog/buy-ontario-so-why-isnt-ontario-buying-canadian-technology/
We are going to keep this thread open for questions on how the records were checked. If you spot a record that has changed since September 8, say so here and we will update the table.
Source: r/Thexyz · by /u/lacbeetle