Zoho MX for GOV.in and NIC.in: Why mgovcloud.in Uses US-Based MarkMonitor and UltraDNS

In 2023, Zoho was awarded the contract, after due process of public tender, to migrate the official hosted email and office suite services for government departments, as well as public sector undertakings (PSUs).

It is a good step to deploy a uniform solution for data sovereignty and privacy. Kudos to Zoho and their hard-working team, who managed to migrate about 12 lakh email addresses of government employees, including Prime Minister's Office (PMO).

Dedicated .in domain name for Government - mgovcloud.in

According to Zoho, everything is hosted in a secure Tier 4 data center with multi-layer cyber security and operation security mechanisms in place under NIC's control.

I see that there is a dedicated domain name, i.e., mgovcloud.in, for this particular use case.

Mail.gov.in literally forwards to mgovcloud.in for authentication and access of hosted services, including office suite and email. Unlike how it was earlier, when NIC.in directly managed the hosted email services for Gov.in.

Why Register mgovcloud.in ccTLD with US based Registrar MarkMonitor Inc.? Don't like India/Bharat's .in Accredited Registrars?

The last time I checked, .in is the ccTLD for our great nation, i.e., Bharat/India. Why would you go to a US-based registrar to register a .in ccTLD? Sure, India's registrars do not have a slick interface from millions that pour in from investments in USA. Sure, they look like a decade old, but you do not really use them daily, do you? Once you have registered a domain.tld, set up your authoritative DNS and other resource records like DS, etc. You do not really log in everyday to enjoy the beauty of it, do you?

I mean, at least try Asian registrars, why is US based the only option in name of data sovereignty? Here at Nixsanctuary, I try to keep it Asian unless there is a weird case of personal domain like firstname.tld, which I mean sure many of you have fallen for.

An accredited provider from Bharat/India that does basics right should be enough. It is about reliance and sovereignty after all.

Why use US based UltraDNS and Zoho's US hosted authoritative DNS for mgovcloud.in?

The whole point of this exercise, to move to hosted services of an Indian vendor, Zoho, is meant to solidify data sovereignty of Bharat/India. NIC has already managed it for years, with little friction. NIC hosts its own authoritative DNS, so if mgovcloud.in's infrastructure is under NIC's control and audited by CDAC independently, how could they ignore this gross data sovereignty issue?

Why isn't Centre of Excellence in DNS Security (CoE-DNS), established by C-DAC (Centre for Development of Advanced Computing) in Bangalore, saying a word or two about it?

I am sure there are many researchers there who know how harmful handing over your domain's authoritative DNS to USA based providers and hosting services can be to your data sovereignty.

To keep it simple, why dial USA to know the IP addresses and other details of MX for gov.in or nic.in and many other PSUs?

See the following DNS trace result. I simply wanted to know the IP address of mx.mgovcloud.in to know where it is hosted. I don't know why it dialed 2610:a1:1015::7e from Ultradns, which is owned by Vercara, LLC in USA — a Digicert Company.

Of course, it is an AnyCast DNS NS, so it would find a local server if available in India, if you traceroute the IPs from India.

$ dig A mx.mgovcloud.in +trace
;; Warning: Client COOKIE mismatch

; <<>> DiG 9.20.23-1~deb13u1-Debian <<>> A mx.mgovcloud.in +trace
;; global options: +cmd
.			38956	IN	NS	e.root-servers.net.
.			38956	IN	NS	b.root-servers.net.
.			38956	IN	NS	i.root-servers.net.
.			38956	IN	NS	d.root-servers.net.
.			38956	IN	NS	k.root-servers.net.
.			38956	IN	NS	l.root-servers.net.
.			38956	IN	NS	j.root-servers.net.
.			38956	IN	NS	c.root-servers.net.
.			38956	IN	NS	f.root-servers.net.
.			38956	IN	NS	g.root-servers.net.
.			38956	IN	NS	m.root-servers.net.
.			38956	IN	NS	a.root-servers.net.
.			38956	IN	NS	h.root-servers.net.
.			38956	IN	RRSIG	NS 8 0 518400 20260722210000 20260709200000 57780 . iPB5aP46iPjM62vCzjzjmUo99v/lG04imD7BTwLvvFCaLkd+l6ZdBwy3 F3jp0P/H2QDee8rlWLitz5GP8InWMfjcwKJVSaNEE4d5r9pA2TmWSo04 VDzKxVhIpTYHS+sWTI5aUGO77biiCf+P3e6UwsLFQ0QfW3WlWtSl76JD BO4b3cMRre6TANOuZe/t8I2qn1MVJhgt6V+6qm0E7rRTFUgjLtrK0nst s1p94DYH5Ysq9+qe14Xy0fOvnNEb6Kkty57YsfoZEr1HtCOlp3G24sFZ BYrDLBy1Itv6T5t85Kz2OaT2OjtPSlUgzcx38D/QUXyMCuI7bZJcJ9Ta 8+VQ3A==
;; Received 537 bytes from 127.0.0.53#53(127.0.0.53) in 0 ms

in.			172800	IN	NS	ns4.registry.in.
in.			172800	IN	NS	ns1.registry.in.
in.			172800	IN	NS	ns2.registry.in.
in.			172800	IN	NS	ns3.registry.in.
in.			86400	IN	DS	10094 13 2 5824EE9A55ED72F0D46D2C3A511F393F05EFC27E73CBD1005BEBBC73 402B6186
in.			86400	IN	RRSIG	DS 8 1 86400 20260723050000 20260710040000 57780 . IhMmkBBFffB6KnEdlnK5z0wY21Mu5U3/YDwQfvMkHVXLhaWT/SK0S6o3 U35OyYVEjarrBOIaeZH8MPR+6YpCaN0DSnxzlzCSDvSO+VswTagN4wEO t3zL0tAF+1chCJbMFeaaQi88CLEdQPBGF15gblEmByD+Mki2oJuZPMVl UMOjbMssnd34HihUJS5rlnxtksz3EdzrNqSGA3/4X42HQ2Cz6XTLO6CD Dz2wT7OuW/j5UBcw8b+fI8BImQCmZoo0T+iFrBLI9jSUHsSbtwhQlrnZ +HaH7KE9yV9diD2U+94GSwg/lGoNze8EPj9NR2p54Z/zv/qAR2wdxhk/ LzPUXw==
;; Received 640 bytes from 202.12.27.33#53(m.root-servers.net) in 235 ms

mgovcloud.in.		900	IN	NS	ns41.zns-53.net.
mgovcloud.in.		900	IN	NS	pdns90.ultradns.net.
mgovcloud.in.		900	IN	NS	ns21.zns-53.net.
mgovcloud.in.		900	IN	NS	pdns90.ultradns.biz.
mgovcloud.in.		900	IN	NS	ns1.zohocorp.com.
mgovcloud.in.		900	IN	NS	ns31.zns-53.com.
mgovcloud.in.		900	IN	NS	pdns90.ultradns.com.
mgovcloud.in.		900	IN	NS	ns11.zns-53.com.
U7SMSLVEUS494O8DR4H483UN5SPUC1TU.in. 300 IN NSEC3 1 1 0 - U7TSQCFM3BLKO8649TCSMRLTU907IJUP NS SOA RRSIG DNSKEY NSEC3PARAM
U7SMSLVEUS494O8DR4H483UN5SPUC1TU.in. 300 IN RRSIG NSEC3 13 2 300 20260721015624 20260621190856 55175 in. i2VHjRCDIn2XXT6dnB5KDkkU8WN/c2nFQ/zOv4nfy5Y3c+PiA+StKh9y ot+qb4WFwlWYHe4zJl+QZOjo01LhjA==
G0M8DJIUO4QM8MU8U882N2RBDUH1FFHU.in. 300 IN NSEC3 1 1 0 - G0N74OE2H2MOFKIBJC3M0S0UCVD7GJVT NS DS RRSIG
G0M8DJIUO4QM8MU8U882N2RBDUH1FFHU.in. 300 IN RRSIG NSEC3 13 2 300 20260801020724 20260703054117 55175 in. y52WgWVrUK8O3Ju9QTbU4/znpG2Lbrv1u/yxUxcaMKI7v5PhMZv/PGXU qttWfoL+0jVo1SDxAoT0qIOFQf2JTQ==
;; Received 654 bytes from 2620:57:4001::1#53(ns1.registry.in) in 15 ms

mx.mgovcloud.in.	600	IN	A	169.148.144.32
mx.mgovcloud.in.	600	IN	A	169.148.144.89
mgovcloud.in.		600	IN	NS	ns1.zohocorp.com.
mgovcloud.in.		600	IN	NS	ns11.zns-53.com.
mgovcloud.in.		600	IN	NS	ns21.zns-53.net.
mgovcloud.in.		600	IN	NS	ns31.zns-53.com.
mgovcloud.in.		600	IN	NS	ns41.zns-53.net.
mgovcloud.in.		600	IN	NS	pdns90.ultradns.biz.
mgovcloud.in.		600	IN	NS	pdns90.ultradns.com.
mgovcloud.in.		600	IN	NS	pdns90.ultradns.net.
;; Received 292 bytes from 2610:a1:1015::7e#53(pdns90.ultradns.biz) in 75 ms

Income Tax Department has literally done it better, isn't it? Don't they deliver important tax queries and documents to taxpayers of Bharat/India? I guess it works. Despite the fact that they host and manage their own authoritative DNS (NS) and Email servers.

Chronology is streamlined, it goes to root servers to registry.in to incometax.gov.in's own DNS in Pune hosted with Tata Communications Limited.

$ dig A incometax.gov.in +trace | grep Received
;; Received 537 bytes from 127.0.0.53#53(127.0.0.53) in 0 ms
;; Received 637 bytes from 193.0.14.129#53(k.root-servers.net) in 48 ms
;; Received 506 bytes from 64.96.1.1#53(ns1.registry.in) in 20 ms
;; Received 127 bytes from 59.160.103.171#53(ns01.incometax.gov.in) in 40 ms

Upon checking further, I found almost everyone, except NIC, Incometax, pmindia.gov.in (PMO), are using US or Canada based authoritative DNS, including gov.in and CDAC:

Gov.in is using Canada-based global registrar Tucows Registry Services' AnyCast DNS for its root.

$ dig SOA gov.in +short
ns.trs-dns.com. trs-ops.tucows.com. 1783696254 1800 900 604800 300

$ dig SOA nic.in +short
nicnet.nic.in. nsadmin.nic.in. 2026071008 1800 0 1209600 14400

I believe Gov.in's DNS hosting should be with NIC to ensure sovereignty. I don't know if Tucows changed the NS during migration, if Gov.in opted for the registry's default settings, or what actually happened.

In May of 2025, Tucows Registry Services (TRS) has bagged the contract to run the backend registry services for India's .in ccTLD from the National Internet Exchange of India (NIXI). It is the operator of .in ccTLD and other extensions. Tucows Registry Services is basically the technical services provider (TSP) for .in registry now.

Tucows Registry Services: We completed the largest ccTLD domain migration — transitioning 4.2 million .in domains for NIXI in just 6 hours, without a single DNS interruption.

As per Tucows, NIXI is now equipped with a modern foundation to serve India’s rapidly growing Internet population and expand access to millions of users.

Bharatiya Janata Party (bjp.org): Ruling party in Centre

The world's largest political party that hails from Bharat. Its domain name is registered with Canadian registrar Tucows, uses US based authoritative DNS by Cloudflare, and US based Google's email services. I see nothing Bharatiya at all.

Unfortunately, not at all vocal for local.

Wait, their website is hosted in Mumbai data center location operated by US based provider Akamai Technologies, Inc. , if you count it as truly Indian and local.

Indian National Congress (INC.in): The oldest political party in India

Same story, INC's domain name is registered with a US based provider, GoDaddy, uses DNS by US based Cloudflare, their email is hosted by US based Google's email services.

No love for Indian providers or registrars at all.

Conclusion

I hope NIC, CoE-DNS wing of CDAC, and other relevant authorities including Registry.in take charge and fix these issues regarding use of foreign registrars and authoritative DNS for our own .in ccTLD that are deployed for government use and public sector projects and services.