Shadow IT for Chrome
Checking whether a domain's email authentication is actually set up usually means three lookups and a careful read of what comes back. This does it in one click. Open any site, click the icon, and the extension reports that domain's SPF, DKIM, and DMARC records — with the verdict attached, not just the raw record.
Chrome Web Store · version 1.0.0 · updated 3 August 2026 · about 26 KB · no account, no sign-up
What it checks
- SPF · who is allowed to send
- Resolves the sending policy and follows the
includeandredirectchains rather than stopping at the first record. SPF silently fails once evaluation needs more than ten DNS lookups, so the extension counts them and flags the domain when it has gone over — the failure mode that breaks mail without anything visible having changed. - DKIM · is the mail actually signed
- Checks the selectors the major platforms use, and takes a custom selector if the domain publishes under one of its own. A domain can look fine on SPF and still be signing nothing.
- DMARC · what happens when it fails
- Reads the policy and grades it —
reject,quarantine, ornone. A published DMARC record set tononeis monitoring, not enforcement, and that distinction is the one most often misread as cover.
How it works
Open the site you want to check
Any page on the domain will do. The extension reads the hostname of the active tab and nothing else — not the page content, not your other tabs, not your history.
Click the icon
It resolves the hostname down to the organisational domain first, so a deep subdomain or an Australian .com.au address is checked against the domain that actually publishes the records, not the label in front of it.
Read the verdict
Each record comes back with the interpretation attached, so the answer is "DMARC is set to none" rather than a raw TXT string you then have to parse yourself.
What it doesn't do
There is no account, no sign-up, and no analytics. It asks for two permissions — the active tab, so it can read the domain you're on, and access to Cloudflare's DNS-over-HTTPS endpoint, so it can run the lookups. Domain names go to Cloudflare because that is what a DNS query is; nothing is sent to me, and nothing is stored. The full detail is in the extension privacy policy.
It also isn't a mail-flow audit. It reports what a domain publishes to the world, which is the first question rather than the last one — it can't see your tenant, your connectors, or who is actually sending on your behalf.
Built for the quick check
It came out of doing the same three lookups over and over — onboarding a client, sizing up a supplier, or sanity-checking a domain before trusting mail from it. If you do that often, this saves the round trip. If it turns up something you'd like a hand fixing, or it gets a domain wrong, I'd like to hear about it — get in touch.
Get it on the Chrome Web Store