Recipient Domain Warning

WHAT IT DOES

Automatically detects recipient email addresses in your webmail interface and warns you when you're about to send messages to untrusted or external domains. The script scans the page for email addresses, extracts their domains, and compares them against your configured list of trusted domains. If any recipient's domain isn't trusted, a prominent warning banner appears with the untrusted domains listed. This helps prevent accidentally sending sensitive company information to external recipients, vendor domains, or personal email addresses. You can permanently trust domains, temporarily whitelist domains for the current session, or override the warning with a confirmation dialog.

WHERE IT RUNS

Works on all major webmail platforms including Gmail, Outlook/Office 365, Yahoo Mail, and any other web-based email interface. Also works on contact forms, support tickets, and any page containing email addresses. The script runs on all websites (match pattern *://*/*) and uses intelligent detection to find recipient addresses wherever they appear on the page.

HOW TO USE

Install the script and it starts automatically. Add your trusted domains (e.g., @company.com, @internal.local) through the panel's "Trusted Domains" section. The script scans the page every time you compose a new email or when the DOM changes, showing real-time status. If untrusted recipients are detected, the banner turns red with a warning message. Click "Scan Now" to manually trigger a scan. Use "Temporary Whitelist" to trust a domain for the current session only, perfect for one-off communications with external partners. Auto-scan toggles on/off via the checkbox.

REAL MECHANISM: DOM TEXT EXTRACTION WITH CONTEXTUAL FILTERING

This script uses a multi-layered extraction pipeline. First, it scans the document's text content using a regex pattern specifically tuned for email addresses while avoiding common false positives like file paths or code snippets. Second, it targets webmail-specific DOM selectors: Gmail's [data-hovercard-id] attributes, Outlook's aria-label fields containing "To", "Cc", or "Bcc", and Yahoo's [data-test-id*="recipient"] elements. Third, it monitors input fields with type="email" or email-related aria-labels. All extracted domains are deduplicated using a Set to prevent redundant warnings. The script then compares each domain against the trusted list using includes() matching, allowing partial matches like "@company.com" matching "user@company.com". The entire scan runs asynchronously via MutationObserver with a 1-second debounce to avoid performance issues during rapid DOM updates. Session whitelist persists through page reloads within the same browser session using GM_setValue with a session-based expiry mechanism.

THE PANEL

Drag the panel anywhere on screen by clicking and holding the header. It snaps to screen edges when released. Collapse it to a small bubble by clicking the minimize button, and expand it back by clicking the bubble. Resize the panel from any corner. Press Escape to close the configuration panel. Your position and size preferences are saved automatically per site.

PLEASE NOTE

This script requires the free BotGentz browser extension which provides the BGPanel framework and storage APIs. Websites change frequently; if the script stops working on a particular webmail interface, check for updates or adjust your trusted domains. All data (trusted domains, temp whitelist, and preferences) is stored locally in your browser using GM_setValue and never sent anywhere. No analytics, no tracking, no external calls. The script only reads email addresses visible on the page and never accesses passwords, hidden inputs, or file fields. It does not read or intercept actual email content or message bodies, only recipient addresses that are visible in the UI.