Two domestic Islamist groups were believed to be responsible for a string of attacks in and around the capital Colombo on Easter Sunday, killing 321 people and wounding about 500 others.
No group has claimed responsibility for the coordinated attacks, which officials said were carried out by at least seven suicide bombers, on three Christian churches and four hotels.
"The initial investigation has revealed that this was in retaliation for the New Zealand mosque attack," junior minister for defence Ruwan Wijewardene told parliament on Tuesday night (NZ time).
He said two Sri Lankan Islamist groups - the National Thawheed Jama'ut and Jammiyathul Millathu Ibrahim - were responsible for the blasts early on Sunday during Easter services and as high-end hotels served breakfast.
An Australian national, who acted alone, is facing multiple murder and attempted murder charges and remains in an Auckland jail. He has yet to plea.
US intelligence sources said the attacks carried some of the hallmarks of the Islamic State militant group, although they were cautious because it had not claimed responsibility.
Islamic State is usually quick to claim responsibility for, or links to, attacks against foreign targets or religious groups, whether it was involved or not, they said.
Prime Minister Ranil Wickremesinghe told parliament investigators were looking into foreign links.
Earlier on Tuesday, Sri Lankan government and military sources said a Syrian had been detained among 40 people being questioned over the bombs.
"He was arrested after the interrogation of local suspects," one of the sources said, referring to the unidentified Syrian.
Most of the dead and wounded were Sri Lankans, although government officials said 38 foreigners were killed. That included British, US, Australian, Turkish, Indian, Chinese, Danish, Dutch and Portuguese nationals.
The United Nations Children's Fund said 45 children were among the dead.
New Zealand's Prime Minister Jacinda Ardern said in a statement following Sunday's attacks: "Collectively we must find the will and the answers to end such violence."
Tuesday was declared a national day of mourning and the funerals of some of the victims were held as pressure mounted on the government over why effective action had not been taken in response to a warning earlier this month about a possible attack on churches by a little-known domestic Islamist group.
Footage on CNN showed what it said was one of the bombers wearing a heavy backpack. The man patted a child on the head before entering the Gothic-style St. Sebastian church in Katuwapitiya, north of Colombo. Dozens were killed there.
The bombs brought a shattering end to a relative calm that had existed in the Buddhist-majority Indian Ocean island since a bitter civil war fought by Tamil separatists ended 10 years ago and raised fears of a return to sectarian violence.
Sri Lanka's 22 million people include minority Christians, Muslims and Hindus. Up to now, Christians had largely managed to keep out of the worst of the island's conflict and communal tensions.
US President Donald Trump called Prime Minister Wickremesinghe on Monday to pledge US support in bringing the perpetrators to justice.
The attacks have also underlined concern over fractures in Sri Lanka's government, and whether the discord prevented action that might have stopped them.
The government received a tip-off from India this month about a possible attack on churches by the National Thawheed Jama'ut.
It was not immediately clear what action, if any, was taken in response. A government minister said on Monday that Wickremesinghe had not been informed about the warning and had been shut out of top security meetings because of a feud with President Maithripala Sirisena.
Sirisena fired Wickremesinghe last year only to be forced to reinstate him under pressure from the Supreme Court. Their relationship is reported to be fraught.
The US State Department said in a travel advisory that "terrorist groups" were possibly plotting more attacks in Sri Lanka.
