Shadow IT

Reads SPF, DKIM and DMARC records for the current site's organisational domain via Cloudflare DNS-over-HTTPS.

Shadow IT reads the email-authentication DNS records for the site you're viewing and shows them at a glance. Open the popup on any website and it automatically looks up the domain's SPF, DKIM, and DMARC records via Cloudflare DNS-over-HTTPS. What it checks: SPF — finds the record, follows include/redirect chains, and flags when the domain exceeds the 10-lookup limit that breaks SPF. DMARC — retrieves the policy and grades its strength (reject / quarantine / none), falling back to the organisational domain for subdomains. DKIM — checks common selectors automatically, with an optional field to enter a specific selector. Shadow IT resolves each site to its correct organisational domain, so subdomains and country-code domains (like .com.au) are handled properly. No account, no setup, no data collected — domain names are sent only to Cloudflare to perform the lookups, and nothing is stored or transmitted to the developer. Built for IT admins, MSPs, and anyone who needs a fast email-security spot-check.