Is Your .ca Website Actually Canadian? Canada's Digital Sovereignty Measured Ten Ways — Only 6.5% of .ca Websites Are Canadian End to End

A .ca domain comes with a citizenship test. CIRA, the registry, sells .ca only to people and organisations that meet its Canadian Presence Requirements. Nothing in those rules says where the website must be hosted, who runs its mail, or whose servers answer for its name — and for most .ca domains, the answer to all three is not Canadian.

Yesterday's Home Advantage Index ranked Canada 64th of 78 countries on how much of its own namespace it hosts, mails and resolves at home. A reader pointed out what a three-layer index leaves out. A serious account of Canada's digital sovereignty, they wrote, needs at least ten things: cloud market share, data-centre ownership, government cloud procurement, submarine-cable and network ownership, CDN concentration, DNS-provider concentration, email-provider concentration, legal jurisdiction, physical data residency, and dependence on US hyperscalers. This post takes the list one item at a time.

The timing is not academic. On September 25, Shared Services Canada opened an Invitation to Qualify for a sovereign government cloud that admits only providers "Canadian owned and controlled" up to the ultimate parent, invoking the national-security exception so that trade agreements do not apply (SSC ITQ). Budget 2025 proposed C$925.6 million over five years for sovereign public AI infrastructure (Budget 2025). Ottawa's own Digital Sovereignty Framework concedes that "storing data in Canada does not guarantee data will be outside the jurisdiction of foreign courts" (TBS). And Canadians say they care: in CIRA's 2026 survey, 67% said it is important that their data be stored in Canada — but only 5% had switched to a Canadian service (CIRA).

We measured what sits behind the country code. For each of the 1,860,851 live .ca websites in our September 2026 crawl we joined three layers, domain by domain: where the website is hosted and who owns that network, who runs its mail (MX), and who runs its DNS (NS). We followed the hosting layer from April 2023 and the mail and DNS layers from April 2025, which brackets the February 2025 tariff shock. We added fieldwork: 4,290 traceroutes from a Rogers home line in Toronto to Canadian-hosted .ca websites, 1,657 RIPE Atlas traceroutes between Canadian probes and Canadian anchors, 893 traces from Toronto to other continents, latency measurements from data-centre probes in Toronto, Montreal and Vancouver to the front doors of the largest web, mail and DNS operators, a 1,500-domain registrar sample from CIRA's RDAP service, and a live check of 989 government websites — every gc.ca domain in the crawl plus the provincial and territorial portals and 46 municipalities — the largest cities and every provincial and territorial capital. The same per-domain join ran on eight other national namespaces for comparison.

The headline: only 6.5% of live .ca websites are Canadian end to end — hosted in Canada on a Canadian-owned network, with Canadian-run mail and DNS. 54.6% run web, mail and DNS entirely on US-headquartered operators, a larger share than Mexico's (40.5%), Australia's (36.8%) or the United Kingdom's (36.6%). Physical and legal geography have come apart: Cloudflare, AWS and Vercel answer Canadians from Toronto and Montreal, and Microsoft keeps Canadian tenants' mailboxes in Canada — but four in five .ca websites (81.2%) have at least one layer run by a US company or hosted on US soil, which is the test the federal government's own sovereignty framework applies. The tariff shock moved sentiment more than the namespace. After February 2025 fewer Canadian-hosted websites left for US data centres, and Canada held up better than Australia, the UK, New Zealand or Mexico on that measure — but by about 4,600 websites, while 22,259 left Canadian hosting for anycast edges, almost all of them US-run, and the share hosted in Canada kept falling. Mail and DNS customers who switched operators moved toward US companies two to five times as often as away from them.

Download: ca-layers.csv — live .ca websites, September 2026 crawl; each layer's denominator is the websites that have that layer

What this post does and does not measure. It measures the public, observable parts of a namespace: where websites answer from, which companies run the mail and DNS records, which networks carry the traffic, where front doors respond, who the registrar is. It does not see contracts, encryption keys, backups, application back ends behind a front door, or where mailbox contents are stored — so "physical residency" here means where the first server a Canadian reaches is, not where the data finally lives. Ownership is attributed to the headquarters of the operating group, which approximates exposure to that country's legal process; it is not a legal opinion on any particular contract.

The Data

Our count of .ca names with a website record (2.92 million) sits below CIRA's 3,539,550 registered .ca domains (CIRA FY26 report) because some registered names publish no address at all. A further 36.2% of the names that do resolve are parked — for-sale pages, registrar placeholders and expired-domain landers identified with the registry of The Parking Lot — and are excluded from every figure below.

Methodology

Live website. A .ca registrable domain whose apex (or, failing that, www) has an IPv4 address and is not parked. One website per domain; a website with k addresses gives weight 1/k to each.

Where a website is hosted. Each address is located with the pipeline of How Much of the Web Runs on Virginia's Grid?: published anycast edge lists first, then round-trip-time measurements, cloud-provider region tags (AWS, Azure, Google Cloud, Oracle) as published at the time of each crawl, provider geofeeds, and finally DB-IP City Lite. Edge means an anycast front door — Cloudflare, Fastly, Wix, Squarespace, Vercel and others — which has no single location; where we say an edge "answers from Canada" we measured it from Canadian vantage points (below).

Who owns the hosting network. The origin autonomous system of each address (RouteViews prefix-to-AS for the crawl date), mapped to its organisation and registration country (CAIDA AS-to-organisation, September 2026), with hand corrections where a group registers its network abroad. We reviewed the 70 largest origin networks of live .ca websites, which carry 93% of them, against PeeringDB and company pages: HostPapa's networks are registered in the US but the company is in Burlington, Ontario; Leaseweb Canada is Dutch-owned; Google's Irish AS is Google; Ting Fiber belongs to Toronto's Tucows. Three buckets for websites in Canada: Canadian-owned network in Canada, US-owned network in Canada (AWS Montreal, Azure Toronto, DigitalOcean Toronto), other-foreign-owned network in Canada (OVHcloud's Beauharnois campus is French-owned).

Who runs mail and DNS. The primary MX and NS operator of each domain, attributed with the rules of the Home Advantage Index: published census labels first, then the headquarters of the operating group (GoDaddy brands count as US, Tucows brands — eNom, Hover, OpenSRS — as Canadian), then hand review, then a ccTLD heuristic. For .ca we corrected six operators the general rules got wrong: OpenSRS Hosted Email (hostedemail.com) and Hostopia's megamailservers.com are Canadian; Netfirms and iPage belong to Newfold Digital (US); domainsatcost.ca's MX is a loopback placeholder (127.0.0.1) and counts as no mail. Self-run mail or DNS — a record under the domain's own name — takes the owner and location of the domain's website host. For the index we validated this on live lookups: the mail host sat in the website's country for 95.9% of sampled domains, and for 195 sampled .ca domains the measured in-Canada share (56.0%, 95% CI 49.0–63.0) bracketed our per-domain estimate (52.4%).

Domestic end to end: the website is hosted in the country on a domestic-owned network, and mail and DNS are run by domestic-headquartered operators (or self-run on that host). Domains without mail are judged on web and DNS. US-run end to end: all present layers run by US-headquartered operators. US-exposed: at least one layer run by a US-headquartered operator, or the website hosted on US soil. Hyperscaler: an address announced by Amazon, Microsoft or Google, or mail or DNS run by them.

Front doors. For the largest web, mail and DNS operators we resolved the live records of sampled .ca domains and pinged the addresses from one data-centre probe each in Toronto, Montreal and Vancouver (Globalping). Light in fibre covers about 100 km per millisecond of round trip, and the three probes are 7 ms (Toronto–Montreal) and 56–68 ms (east–west) apart, so a reply under 3 ms places a server in that metro, and replies over 8 ms from all three place it outside Canada's three hosting metros. For CDNs we also read the point-of-presence code each edge stamps on its responses (colo=YYZ, x-amz-cf-pop: YUL62, x-vercel-id: yul1::iad1) from 10 home connections in 10 Canadian cities. Where a data-centre probe and our home line disagreed, we traced the address from the home line and used the router names: this moved Microsoft 365 into Toronto (below).

Routes. Traceroutes with mtr (ICMP, three probes per hop) and RIPE Atlas's built-in anchoring measurements. A router is placed in a country only on positive evidence: its address on an exchange-point LAN (PeeringDB) or a location code in its name (ord7.us.zip.zayo.com, ct8-chicago.as6453.net, sea-b1-link.ip.twelve99.net), and only if its round-trip time is physically possible from the source. Unplaced routers count as not American, so every boomerang rate here is a lower bound. A boomerang is a Canada-to-Canada path with at least one router placed in the US; we also report the stricter share where the path is seen leaving the country and coming back.

Known limitations. The hosting crawl sees IPv4 website records only; a site that answers from a different place over IPv6 is classified by its IPv4 address. GeoIP mislocates some networks (we found a Zayo block carrying federal websites listed in Denver and corrected it by traceroute; see the government section). Operator headquarters is a proxy for legal exposure, not a finding about any contract: a Canadian subsidiary of a US group counts as US. Our domestic traceroutes come from one home line plus the RIPE Atlas probes and anchors in Canada, which over-represent data centres and technically engaged hosts. A front door's location is not where mail or data is stored.

Reproducibility. Every chart has its CSV; supplementary tables are linked at the end. The pipeline (Python and the gridscan tool, with the RouteViews, CAIDA and PeeringDB snapshots it used) is described in the closing note.

The Scorecard: Ten Tests

Canada does not fail every test equally. It does well where institutions made a deliberate choice — the federal government's web estate, the registrar market Tucows and a dozen Canadian registrars still hold, the IXPs CIRA helped build that pulled domestic routes home. It does worst where the defaults of a few platforms decide: website builders, registrar DNS, productivity suites. The ten dimensions below are grouped by layer.

Who Runs a .ca Website: Canadian in Name, American in Operation

More than half of the .ca web is American from top to bottom. Among the 1.46 million live websites whose three layers we can attribute, 54.6% have their website, mail and DNS all run by US-headquartered companies; another 24.1% have one or two US layers; only 21.3% have none. The typical all-American .ca website sits behind Cloudflare or on Squarespace, Namecheap, AWS, Newfold or GoDaddy, with Cloudflare, GoDaddy or Namecheap DNS; 42% of them have no mail, and most of the rest use Google Workspace or Microsoft 365.

Only 94,077 .ca websites are Canadian end to end — 6.5%. They cluster on a handful of Canadian hosts: HostPapa, GloboTech, Aptum, Tucows, GTHost, easyDNS, Canadian Web Hosting and Hostopia account for three quarters of them.

Download: ca-peer-stack.csv — live websites, September 2026 crawl, same per-domain method for every ccTLD; includes .us as a reference

By the end-to-end measure, Canada is the most American namespace we compared outside the United States itself. Mexico hosts and mails even more of its namespace with US operators than Canada does (web 70.9%, mail 64.9%), and almost nothing in .mx is Mexican end to end — but its DNS is far less American — US operators answer for 39.8% of .mx websites against 56.4% in .ca, and Mexican operators for 23.9% — so fewer .mx sites are American on every layer. (End-to-end shares use the websites whose layers are all attributable as their base, so they are not bounded by the per-layer shares.) Australia and New Zealand share Canada's anglophone market structure yet keep two to three times as many sites domestic end to end, because their hosting markets kept domestic providers in the defaults. Germany, France and Japan show what a namespace looks like when domestic hosting companies sell the domain, the DNS and the mailbox together.

Physical Residency vs Legal Jurisdiction: The Front Door Is Often in Toronto, the Keys Are Not

On the physical test, the .ca web is more Canadian than its ownership. Counting where the first server a Canadian in Toronto, Montreal or Vancouver reaches is, 49.7% of live .ca websites answer from inside Canada — 21.7% hosted here and 28.0% through anycast nodes in Canadian cities — against 11.3% whose hosting network is Canadian-owned. The edges that answer from Canada belong to Cloudflare, Vercel, AWS, Fastly, WordPress.com, Google and Render; the 15.1% behind Wix, Squarespace and a few smaller edges answer from the US, as does the 27.5% hosted there.

Edges put the front door in Canada and leave everything else where it was. A request to a Vercel-hosted .ca site from Toronto returned x-vercel-id: yul1::iad1 — served at Vercel's Montreal edge, computed in its Washington, D.C. region (iad1). Shopify's 78,859 .ca storefronts (4.2% of live .ca websites) answer from Cloudflare's Toronto node (colo=YYZ) on behalf of a company headquartered in Ottawa. The physical map and the legal map of the same request can point to three different countries.

Mail and DNS front doors

Download: ca-front-doors.csv — Globalping ICMP ping, 3 packets, October 4, 2026; one data-centre probe per metro; addresses resolved live from sampled .ca domains

Mail and DNS front doors split by operator, not by country. Google receives .ca mail in Montreal and Microsoft in Toronto, so 55.6% of mail-using .ca websites hand their mail to a server in Canada — even though Google Workspace cannot store it there. Namecheap, GoDaddy, IONOS and Tucows's OpenSRS receive it outside Canada. DNS is less local (38.3%): Cloudflare and the hosts that white-label it answer from Toronto, but GoDaddy, the Google Cloud DNS behind Wix and Squarespace, NS1 and Tucows's eNom and Hover answer from the US. Microsoft's case shows why we cross-checked: our Toronto data-centre probe reached Exchange Online Protection in 14.4 ms, which alone would suggest a US location, but the Rogers home line reached the same addresses through Microsoft's Toronto routers in 7–11 ms — as fast as the routers themselves — and a control address in Azure's Toronto region answered the same data-centre probes in 16.7 ms. The probes' providers reach Microsoft's network indirectly, so for Microsoft we use the home-line traceroute. Every other "outside" verdict was confirmed from the home line, where those servers took 22 ms or more against 7–13 ms for Toronto targets.

Cloud: Canadian Regions Exist; Canadian Websites Mostly Don't Use Them

Counts are website weights in each cloud's regional address space; edge services (CloudFront, Global Accelerator, Google's load balancers) are counted with the CDNs, not here. Region launch dates from the providers' announcements (AWS, AWS Calgary, Microsoft, Google Montreal, Google Toronto).

Nine of ten .ca websites in the big clouds run in another country's region. The data → inference chain is short: AWS has offered Montreal for nearly ten years, and still only 12.8% of the .ca websites in AWS regions use it; for Google Cloud the figure is 3.5%. This is consistent with what defaults decide: platforms that run in the clouds choose one region for all their customers, and a .ca site on such a platform inherits us-east-1. Azure is the exception — 48.6% of its .ca websites sit in Toronto or Quebec City — consistent with Microsoft's base among Canadian public-sector and enterprise customers who choose the region themselves.

The market-share question is still unanswered by anyone outside the vendors. The commonly cited 85% US share of Canadian cloud spending (AWS 42%, Microsoft 31%, Google 12%) is a model scaled from global revenue by GDP, not a measurement, and it counts no Canadian providers (Canadian Anti-Monopoly Project); no analyst firm publishes a Canadian vendor split. The federal government's own spending is measured: Shared Services Canada's brokered cloud spend from 2019-20 to 2022-23 was about C$310 million, 66% of it with Microsoft (SSC evaluation), and the government told Parliament it has spent almost C$1.3 billion with US cloud firms since 2021 (Canadian Press).

Data Centres: Half the Canadian-Hosted Web Sits on Foreign-Owned Networks

The largest landlord of the Canadian-hosted .ca web is French. OVHcloud's Beauharnois campus south of Montreal hosts 28.5% of all .ca websites located in Canada, up from 16.7% in 2023. Most of the jump is one customer move: 14,973 websites moved from IBM Cloud's Montreal network to OVHcloud's in the same metro between January 2025 and September 2026 — a US-owned host replaced by a French one without a single site leaving Quebec. The US share fell for the same reason, not because Americans left.

Buildings tell the same story at a different grain. Of the 166 interconnection facilities PeeringDB lists in Canada, at least 54 belong to US-headquartered operators — Cologix runs 23 and Equinix 16, including the 13 data centres it bought from Bell in 2020 — against 62 attributable to Canadian owners such as eStruxture (15). The Investigative Journalism Foundation counted 84 of Canada's 283 data centres (29.7%) as US-owned in 2025, by building rather than capacity (IJF). No public source gives megawatts by owner.

CDN Concentration: 43% of the .ca Web Answers From Someone Else's Edge

Canada is one of the most edge-heavy namespaces in the world. In the index, only Nepal had a larger share of its websites behind anycast front doors. The edge share rose from 28.1% of live .ca websites in April 2023 to 35.0% in January 2025 and 43.1% in September 2026, and almost all of the growth is US-headquartered. W3Techs, measuring popular sites rather than the whole namespace, finds Cloudflare in front of 88.3% of .ca sites whose reverse proxy it can identify (W3Techs).

Edges are where location and control separate most sharply. Cloudflare runs seven Canadian cities (Cloudflare) and our probes reached it in under a millisecond from Toronto. Wix and Squarespace, which together front 14.6% of live .ca websites, have no front door in Canada that our probes could reach: the nearest answered in 8.9 ms or more from Toronto, Montreal and Vancouver, which places it in the US.

Where an edge answers also depends on where the user is. From 10 home connections across Canada, Cloudflare served the City of Montreal's website from Toronto, Montreal, Vancouver or Saskatoon for eight of them — but from Seattle for a TELUS line in Edmonton and from Chicago for a Shaw line in Winnipeg. CloudFront served the City of Toronto's website from Montreal, Calgary or Vancouver, but from Minneapolis for the Winnipeg and Saskatoon lines. For the Prairies, "answers from Canada" is a statement about the edge operator's peering, not about the site.

DNS: GoDaddy Holds the Parked Names, Cloudflare Holds the Live Web

GoDaddy's dominance of .ca DNS is mostly a dominance of names nobody uses. Across all 2.7 million delegated .ca names, GoDaddy's domaincontrol.com answers for 40.1% — the default nameservers of the largest .ca registrar, including its parked inventory. Among live websites its share falls to 14.0%, level with Cloudflare. Among operator-run DNS for live .ca websites the Herfindahl–Hirschman index is 720, against 1,439 for operator-run mail: DNS is spread over more operators.

Several hosts' DNS brands run on Cloudflare's network. HostPapa's hostpapa.com nameservers answer from Cloudflare's address space, as do Netfirms', Bluehost's, DreamHost's, Porkbun's and Hostinger's. Attributing DNS by the nameserver's brand, as every census including ours does, therefore overstates domestic control: 1.2 points of the 18.6% we credit to Canadian DNS operators are served by a US operator's network. Tucows, the largest Canadian registrar group, answers DNS for its eNom and Hover customers from US servers.

The .ca zone itself is half outsourced. CIRA runs two of the four .ca nameservers (any.ca-servers.ca, c.ca-servers.ca); the other two are operated by DENIC Services, the commercial arm of Germany's .de registry (d), and by Packet Clearing House (j, AS42, US) — our measurement of the zone's NS set, October 4, 2026. From our probes, CIRA's two servers and PCH's answered from Toronto or Montreal in about a millisecond; DENIC Services' took 34 ms or more from every Canadian city we measured. Running secondaries with foreign operators is standard registry practice for resilience; it means a resolver in Canada can be answered about .ca from outside Canada.

Email: Google and Microsoft Run a Third of .ca Mail; Only Microsoft Offers Canadian Storage

US operators run 60.9% of .ca mail, and the two suites that matter split on residency. Microsoft has stored Exchange Online mailbox content in Canada for Canada-provisioned tenants since May 10, 2016 (Microsoft). Google Workspace offers data regions only for the US and Europe (Google), so the 18.8% of mail-using .ca websites on Google Workspace cannot choose Canadian storage at all, even though their mail enters Google's network in Montreal. Zoho, an Indian company, opened Toronto and Montreal data centres in November 2023 and serves 7,484 .ca domains from zohocloud.ca.

The largest single mail operator for .ca websites is nobody in particular. 27.7% of mail-using .ca websites run mail on their own name, usually on the same server as the website — so the mail layer inherits much of the hosting layer's geography and ownership.

Government: Ottawa Hosts at Home and Mails Through Microsoft

Ottawa's web estate is the most Canadian part of the namespace. Of 924 live federal websites, 708 answer from Shared Services Canada's own network and 750 (81%) from Canadian-owned networks in Canada. Another 126 run on US-owned infrastructure in Canada: Microsoft Azure in Toronto and Quebec City (90), and a Zayo address block that geoIP databases place in Denver but that a TCP traceroute followed to Allstream's Ottawa core — it carries the Privy Council Office's domains, primeminister.gc.ca and clerk.gc.ca among them. Only 7 federal websites are hosted outside Canada. Federal DNS is overwhelmingly run in-house (866 of 924). The federal portal canada.ca itself answers through Akamai, a US CDN. One federal site shows the boomerang in miniature: from our Toronto line, mybonds.gc.ca, hosted in Toronto, was reached through Zayo's routers in Ashburn and Chicago.

Federal mail runs through Microsoft. Of 329 federal domains that receive mail, 214 (65%) hand it straight to Microsoft 365 — canada.ca, cra-arc.gc.ca and tbs-sct.gc.ca among them — consistent with Shared Services Canada's report that 37 of 45 partner departments had moved to Exchange Online by 2024-25 (SSC). A further 96 route mail through government-run gateways first. National Defence still runs its own mail servers (forces.gc.ca).

The provinces and cities are further out. All 18 provincial and territorial domains that receive mail use US-headquartered operators: 16 Microsoft 365, and Manitoba's two Proofpoint. Seven of the 19 provincial and territorial portal names are hosted on Canadian-owned networks in Canada — Alberta's, Nova Scotia's, Newfoundland and Labrador's and the Northwest Territories' on their own networks, Manitoba's two on Shaw's and one of Prince Edward Island's on Bell's — and 11 answer through edges that our probes reached in Toronto or Montreal: Cloudflare for seven, Radware (an Israeli company) for Ontario's two names and one of Prince Edward Island's, CloudFront for Quebec's. Cities lean furthest: 38 of 46 municipal domains run mail on US operators (28 on Microsoft 365), 28 of 46 websites sit behind edges and 9 on US clouds' Canadian regions, and only 8 on Canadian-owned networks. CIRA's D-Zone DNS service answers for six cities and three provinces.

Routing and Cables: The Boomerang Has Shrunk; the Exits Have Not

Download: ca-routing.csv — traceroutes of October 4, 2026; routers placed only on positive evidence (exchange-point LAN or router name, RTT-checked)

Domestic traffic mostly stays home now. In early 2015, 2,049 of 9,233 Canada-to-Canada traceroutes in the IXmaps database (22%) passed through the US (Clement & Obar 2015); a 2013–2016 Packet Clearing House study for CIRA put it at 64% of 2.2 million traceroutes (CIRA). In October 2026, 5.6% of paths from Canadian RIPE Atlas probes to Canadian anchors crossed a router we could place in the US, and 10.8% of paths between Canadian anchors. From our Rogers line in Toronto, 6.3% of randomly chosen Canadian-hosted .ca websites (weighted by website) were reached on paths we saw leave Canada and come back; 13.1% passed at least one US router, but that upper figure includes destinations that geoIP places in Canada and that are in fact in the US. The methods differ — the earlier studies used other targets and other ways of placing routers — so the comparison is directional, but it points the same way as the six exchange points CIRA says it built on the findings of its 2011 PCH study.

The detours that remain are specific. From the same Toronto home line, a website hosted by Aptum in Vancouver was reached through Telia's routers in Chicago and Seattle; a Leaseweb-hosted site in Montreal through Tata Communications in Chicago; an OpenSRS server on Tucows's Toronto network through Cogent in Cleveland and Ashburn. The US cities on boomerang paths are the usual ones: Chicago, New York and Newark, Seattle, Ashburn. Satellite is the outlier: Starlink paths from Canadian probes crossed into the US 38.9% of the time, against none for TekSavvy or Videotron.

Foreign networks carry Canadian traffic even when it stays in Canada. Between the source's ISP and the destination's network, a transit network registered outside Canada — Cogent, Hurricane Electric, Tata, Lumen, Arelion (Telia), Zayo — carried 39.8% of the Toronto-to-Canadian-site paths (weighted by website) and 26.7% of the Atlas probe-to-anchor paths, mostly on routers inside Canada. Canada's Telecommunications Act limits foreign ownership of large facilities-based carriers but explicitly exempts international submarine cables (s.16(5)(a)).

The exits are American. Of 407 traces from Toronto to RIPE Atlas anchors on other continents where we could see the hand-off, 291 (71.5%) left North America from a US router — Boston, New York and Newark for Europe; Seattle, San Jose and Los Angeles for Asia and Oceania. In no trace was the last placed North American router in Halifax or Vancouver. TeleGeography lists 21 cables landing in Canada; only four reach another continent — Google's Topaz to Japan, two EXA cables from Halifax, and Greenland Connect — and none is Canadian-owned (TeleGeography). Canada's largest exchange point, Toronto's TorIX (234 networks in PeeringDB), is smaller than Seattle's SIX (370).

Legal Jurisdiction: Four in Five .ca Websites Answer to US Law Somewhere in the Stack

On the federal government's own test, the .ca namespace is mostly under US jurisdiction. Treasury Board's white paper on data sovereignty puts it plainly: "As long as a CSP that operates in Canada is subject to the laws of a foreign country, Canada will not have full sovereignty over its data" (TBS). The US CLOUD Act lets US authorities compel a US provider to produce data it controls wherever it is stored; Canada and the US opened negotiations on an executive agreement under it in March 2022 and have not concluded one (Lawfare). On June 10, 2025, Microsoft France told a French Senate inquiry under oath that it could not guarantee French customer data would never be handed to US authorities (Sénat); Microsoft's December 2025 Canadian pledge commits it to "challenge" such demands, not to refuse them (Microsoft). None of this removes Canadian law: data in AWS Montreal or Azure Toronto is covered by Canadian privacy law too. What the 81.2% measures is that it is not covered by Canadian law alone.

The registrar is the most Canadian layer — and it is still not majority Canadian. In a random sample of 1,500 live .ca websites, 44.7% were registered through registrars whose parent group is headquartered in the US and 41.4% through Canadian groups, led by Toronto's Tucows (19.3%). Every registrar of record carries a Canadian legal name — Go Daddy Domains Canada, Inc.; Network Solutions Canada ULC — so the registry's own records read as Canadian; the parent does not. Namecheap appears in CIRA's records as "Go Get Canada Domain Registrar Ltd."; we identified it by its customers' default nameservers. The registrar holds the account that can change a domain's nameservers, which makes it the layer an attacker or a court order needs to redirect everything else.

The Tariff Test: No Homecoming

Download: ca-switching.csv · ca-operator-switches.csv — hosting: websites live at both ends of each window, moves between hosting buckets; mail and DNS: domains with an attributable operator in both crawls, operator HQ held at its September 2026 state

February 2025 is a natural experiment, and the namespace barely responded. The windows before and after the tariff threats are almost equally long (21.6 and 19.8 months) and the panels almost equally large. In Canada the net flow of websites from US data centres to Canadian ones rose from +20.3 to +27.1 per 100,000 per month, mostly because fewer Canadian-hosted sites left for US data centres (47.7 → 39.4). In the four comparison namespaces, which faced no such shock, the same net flow fell or held (median change −13). Read as a difference-in-differences, Canada's hosting held up better than its peers' by about 20 websites per 100,000 per month — some 4,600 websites over the window, 0.4% of the panel. That is consistent with a small "buy Canadian" effect at the margin, under the usual caveat that the peers are not a perfect control. It is far too small to show in the totals: departures from Canadian hosting to anycast edges rose 45% (65.7 → 95.5), much as they did in Australia (+43%) and New Zealand (+51%), and the share of .ca websites hosted in Canada fell from 24.7% to 21.7%.

Mail and DNS switching ran the other way. Among .ca domains with an attributable operator in both April 2025 and September 2026, 3,262 moved mail from a Canadian to a US operator and 695 the reverse — 4.7 to 1. In DNS it was 15,482 to 7,929. The largest single DNS flows were platform changes rather than owner decisions — Web Hosting Canada and HostPapa customers ending up on Cloudflare's nameservers — which is the point: the defaults moved, and the defaults are American. The mail and DNS series start in April 2025, two months after the first tariff announcement, so they miss any switching in February and March. CIRA's own survey points the same way as the data: sentiment shifted, behaviour mostly did not.

Dependence on US Hyperscalers: Broader Than Three Companies

Measured by the three hyperscalers alone, Canada looks unremarkable. 37.1% of live .ca websites touch Amazon, Microsoft or Google on at least one layer — less than Australia or New Zealand. Canada's American dependence is wider than the big three: GoDaddy, Namecheap, Newfold Digital, Squarespace and Cloudflare appear on at least one layer of 49.6% of live .ca websites, more than Amazon, Microsoft and Google combined. A sovereignty policy aimed at hyperscaler contracts would miss most of the companies the .ca namespace actually depends on.

How These Numbers Compare

Popular sites lean American more than the long tail does. W3Techs samples the most-visited .ca sites and finds more of them in the US and on GoDaddy's and Cloudflare's DNS than we find across all 1.86 million live websites; that is the direction one would expect, since large sites use large providers. Every comparator agrees on the order of magnitude, and none measures more than one layer.

What's at Stake

• The sovereign-cloud tender addresses the government, and the government is the part that is already Canadian — the federal web estate runs on Shared Services Canada's own network, and federal DNS is run in-house. The gap is mail (Microsoft 365) and the provinces and cities (US mail operators for 18 of 18 provinces and territories and 38 of 46 cities). Outside government, 1.86 million .ca websites are governed by platform defaults no procurement rule reaches.
• Location is not control, and Ottawa's own framework says so. Cloudflare, AWS and Vercel put Canadian traffic through Canadian front doors, and Microsoft stores Canadian tenants' mailboxes in Canada. Under the federal white paper's own test, those services remain subject to US law. Counting where Canadians are answered would score half the .ca web (49.7%) as Canadian; counting who runs the hosting scores 11.3%.
• A handful of platform decisions move more of the .ca namespace than Canadian policy has. One host's migration moved 14,973 websites from a US-owned to a French-owned network in Montreal; Wix and Squarespace alone front 14.6% of live .ca websites from outside Canada; registrars' default nameservers decide DNS for most of the rest. Concentration on a few operators is one input to resilience, as the Rogers outage of July 2022 showed for a domestic one.
• The boomerang has shrunk where Canada built infrastructure. Domestic paths that once crossed the US 22–64% of the time now do so 6–11% of the time, consistent with the exchange points CIRA and others built after 2011. The international exits — and every intercontinental cable — remain foreign.
• The registry is part of the stack too. Half of the .ca zone's nameservers are run by foreign operators. That is normal resilience engineering, and also a reminder that "Canadian" is a property of each layer, not of the domain.

What Would Help

1. Federal and provincial governments: measure the namespace, not just the contracts. The sovereign-cloud ITQ and Budget 2025's sovereign-compute money target the public sector's own workloads. A yearly, layer-by-layer measurement of where .ca and Canadian government domains live — this post's method, or CIRA's — would show whether any of it reaches the 1.86 million sites outside government. Provincial and municipal mail is the obvious next procurement question: 18 of 18 provinces and territories run mail through US operators.

2. CIRA: publish operator and location statistics for .ca, and report the zone's own dependencies. CIRA already sees every delegation and runs the .ca zone with two foreign secondaries. A yearly table of .ca DNS and mail operators by headquarters, websites by location, and the share answered from Canada would replace estimates like ours with the registry's own numbers — and its traceroute database with IXmaps, announced as "coming soon" in February 2026, could make the boomerang a tracked statistic.

3. Canadian hosting companies and registrars: compete on the defaults. The all-Canadian .ca website exists — 94,077 of them — almost entirely on Canadian hosts that bundle the domain, DNS and mail. Tucows, the largest Canadian registrar group, serves its own customers' DNS and hosted mail from the US; moving those front doors north would move more of the namespace than any campaign. White-label DNS on Cloudflare should be disclosed as such.

4. Platforms that already run Canadian regions: make them the default for .ca. AWS, Google Cloud and Oracle have Canadian regions that 87–97% of the .ca websites in their address space do not use. Builders and hosts that pick one region for all customers could pick by country code; Google could add Canada to Workspace data regions, as Microsoft and Zoho have.

5. Site owners: check your own stack. dig NS yourdomain.ca, dig MX yourdomain.ca and a lookup of your website's address show in a minute who answers for your domain. If you care where your data lives, the provider's headquarters matters as much as its data centre.

Methodology. Web layer: the DomainsProject A-record crawls of April 6, 2023, January 23, 2025 and September 17, 2026, located as in How Much of the Web Runs on Virginia's Grid? and attributed to origin AS (RouteViews prefix-to-AS of each crawl date) and organisation (CAIDA AS-to-organisation, September 2026). Parked domains are excluded using the registry of The Parking Lot. Mail and DNS: the apex MX and NS tuples of MX Flux and Who Moves the World's DNS, April 10, 2025 and September 20–22, 2026, attributed with the rules of the Home Advantage Index plus six .ca corrections. Fieldwork on October 4, 2026: mtr 0.95 from a Rogers home line in Toronto; RIPE Atlas anchoring measurements; Globalping probes; CIRA RDAP; live DNS and HTTP for government domains. Routers located with PeeringDB (October 4, 2026) and router names, checked against round-trip time.

Excluded from every figure: parked domains, private-suffix pseudo-apexes and Russian-administered TLDs. External facts are linked inline and were checked against primary sources.

Data: peer comparison, layers, front doors, routing, switching, government websites, hosting networks in Canada. For the 78-country comparison see the Home Advantage Index; for .ca registration statistics see the .ca TLD page, and get the data on the dataset page.