Why I built JayQuery
Every so often a project comes out of a conversation you weren't even trying to turn into a project. JayQuery is one of those. It's a free Chrome and Edge extension that checks a website's DMARC, SPF, and DKIM (plus a handful of the DNS records around them) the moment you land on a tab, and scores what it finds out of 10. This post is the story of why it exists and what it's actually for.
It started with Jay complaining
I'm part of the MSPs in the UK Discord server, and one of the regulars there, Jay, would not let DMARC go. Every few weeks another domain would come up in conversation — a supplier, a competitor, a company in the news for a phishing incident — and Jay would want to know, right then, whether they had DMARC enforcement in place. Not "I'll check it later on MXToolbox." On the go, from whatever tab he was already looking at.
That's a completely reasonable thing to want and, at the time, there wasn't a good way to get it. You either ran something like DNSHealth locally, or you pasted a domain into a web tool and waited for a page to load. Neither of those fits "I'm scrolling LinkedIn and I want to know right now."
Built on an AI evening, as a bit of a dare
The push to actually build it came out of one of our community's "AI evening" sessions, where a few of us get together and see what we can get an AI coding assistant to produce in a short session. Myself and another regular in the server, Lewis, decided JayQuery would be our project for the evening — partly to solve Jay's problem, and partly as an excuse for a friendly Cursor-versus-GitHub-Copilot bake-off. I was on Cursor, and I wanted to see how close I could get to a working, shippable extension in one shot.
I wasn't starting from nothing conceptually. I'd already been leaning on the DNSHealth PowerShell module inside CIPP for exactly this kind of check, so I knew what "good" looked like — SPF and DMARC evaluated properly, DKIM checked against common selectors, the DNS resolved over something that wouldn't leak the lookup to whatever recursive resolver the machine happened to be using. JayQuery is that same set of checks, rebuilt in TypeScript for the browser: DNS-over-HTTPS to Cloudflare (with Google as a fallback), SPF/DMARC/DKIM evaluated with a proper pass/warn/fail breakdown, and MX, NS, MTA-STS, TLS-RPT, and DNSSEC checked alongside them.
I was also deliberate about what it doesn't do. It doesn't inject anything into the page, and it doesn't ask for broad host permissions — it reads the active tab's hostname once navigation finishes, and the only network calls it makes are to Cloudflare's and Google's DoH endpoints (plus one Entra probe). If you're going to hand an extension to clients and colleagues, it has to be able to survive someone actually reading the permissions list.
Shipping it, and closing the loop with the Wall of Shame
An evening's prototype is not the same as something you'd hand to a client, so we kept going after that first session — proper tests, a scoring breakdown people could actually read, and eventually a release to the Chrome Web Store and Edge Add-ons.
One feature I'm particularly happy with closes the loop between checking a domain and doing something about it. I've contributed to dmarcwallofshame.org — the public, education-focused list of domains with no DMARC record or a policy stuck on p=none — and JayQuery can now submit a domain straight to it. If a site you're looking at has no DMARC, or DMARC set to monitor-only, one click opens a pre-filled GitHub issue against the Wall of Shame with the domain, the record (or lack of one), and the right issue type already selected. What used to be "huh, that's bad, someone should flag that" is now genuinely a few-second action.
What it's actually used for now
Jay still uses it exactly the way he originally wanted: open a tab, glance at the toolbar icon, know instantly whether a domain's email security is in order.
The use case that's genuinely surprised us, though, has been on the sales side. Our new-business team now uses JayQuery during prospecting and onboarding conversations — pull up a prospect's domain, and in one glance you've got a concrete, specific, easy-to-explain security gap you can offer to fix as part of onboarding. It's a quick win for the client (a real bump in both security and email deliverability), and it's a quick win for us — it's the kind of small, visible fix that keeps us positioned as the trusted partner rather than just the ticket queue.
Try it
JayQuery is free and open source (PolyForm Noncommercial licensed) — install it, poke at the code, or send Jay your thanks:
And if you land on a domain with no DMARC record, do the internet a favour and report it to dmarcwallofshame.org — JayQuery will even fill in the form for you.