iCloud+ Hide My Email addresses will remain on icloud.com

iCloud+ Hide My Email addresses will remain on icloud.com(developer.apple.com)

607 points by K7PJP 44 days ago | 206 comments

kqp 44 days ago |

This is a huge selling point. Private email relays often get blocked, the only lasting solution is to put them on the same domain as, and in the same format as, a significant number of non-private email addresses. As far as I’m aware the only other provider doing this is Fastmail.

Comments about lock-in aren’t wrong, but it has to be this way. You can make arbitrary email addresses at your own domain, but anybody who feels like it can trivially automatically detect that those are all you.

Personally I use unique at own domain only where I’m identifying myself anyway, like my bank, and Fastmail masked email where I’m not. For most things it’s not actually that terrible to accept a small risk that they’re offline for a day between your being booted without warning and you changing your email address with them.

glenngillen 44 days ago | |

Totally agree with unique at own domain isn't actually privacy. It wouldn't take much of a paper trail to work out the details.

I continue to use it everywhere for a few reasons:

- if someone emails me acting all friendly like we've had some previous relationship but it's sent to linked@mydomain or github@mydomain I know they've just scraped my contact details and it's spam

- similarly, if a vendor leaks or sells my data and I start receiving marketing from somewhere I don't expect it's easier to trace the source of the leak (and in some cases just blackhole that entire email address)

- I already use a password manager and have different passwords on every site, but having a different email address too raises the barrier further for someone trying to script an automated attack based off some other pwned data set.

cube00 44 days ago | | |

> - similarly, if a vendor leaks or sells my data and I start receiving marketing from somewhere I don't expect it's easier to trace the source of the leak (and in some cases just blackhole that entire email address)

This is exactly why I do it, it's eye opening to see exactly which companies leaked your address. As a result of being able to blackhole the leaked addresses I no longer get any spam, the Dvorak dream.

I actually caught a company outright selling my address to AWS of all places, I didn't even know Amazon purchased mailing lists.

AWS were crafty because they didn't directly sell a service, they only offered "resources" for "business leaders" because they knew nothing about what I might need.

Explore the AWS [REDACTED] where business leaders can access eBooks, guides, and customer stories to find practical advice on building or improving upon a data strategy. Learn how you can leverage data as a strategic asset, make better decisions with insights from data, and innovate faster.

jiveturkey 44 days ago | | |

But all 3 of those use cases, plus privacy, can be addressed with word.salad@bigdomain.com. So you may as well get the privacy bit in there.

kqp 44 days ago | | |

I agree with all of this. I’d add that it’s useful for sorting and searching. Things like keyword matching, from address, and from domain aren’t as consistent as you’d hope, but companies do need to actually email the address they were given, so you can use it to reliably identify emails from them.

riddlemethat 44 days ago | |

I configured about a dozen domains to have MX records for the mailinator disposable inbox service for about a decade for free as a gift and the domains were toxic for any other email use case for years afterwards… they were so abused you couldn’t even sign up for most web services with any email associated by the time I stopped renewing them… there are still GitHub lists of disposable email addresses that list to blacklist those domains (and many other), so, I agree. If the big providers don’t offer disposable email addresses there is no good option.

mrweasel 43 days ago | | |

So assuming that I wanted a domain, which would be worthless on any mailing listing and pretty much any service, only good for regular emails, then letting them sit a mailinator aliases for a year or so is a good option?

Sadly mailinator and similar services aren't really working anymore.

nunez 44 days ago | | |

Mailinator was an awesome service when it first worked. Thank you!!!

ocdtrekkie 44 days ago | | |

The reason it's toxic is because the Venn diagram between disposable email addresses and email addresses used for CSAM is a circle: If you accept disposable email and allow users to upload anything, you will have CSAM.

Whereas a Fastmail masked email or iCloud relay is still in the backend tied to your real account and identity which means it provides privacy generally for you but is traceable enough that it is unappealing for predators.

tjoff 43 days ago | |

> You can make arbitrary email addresses at your own domain, but anybody who feels like it can trivially automatically detect that those are all you.

You assume that the domain is used by one person or what?

Also, the point of these is typically to prevent spam. Noone is going to spend a fraction of a cent or second to try and figure out who is behind the adress.

leshenka 43 days ago | | |

> You assume that the domain is used by one person or what?

Yes. It's not a guarantee but you can identify several strong signals that suggest that.

> point is to prevent spam

also yes

jdoe1337halo 43 days ago | |

Yep I have a few @firefox.com addresses from the inital launch of Firefox Relay. Come in handy for some of the more stubborn sites that block private addresses.

teekert 44 days ago | |

Indeed, Proton’s passmail are sometimes not accepted sadly.

8cvor6j844qw_d6 44 days ago | |

> This is a huge selling point.

Same thoughts. I'm annoyed with the number of services that blocks alias domains.

At least I don't see services attempting to block @icloud.com domains.

chrisweekly 43 days ago | |

Fastmail is awesome. Happy customer for many years. Zero problems.

hollow-moe 44 days ago |

Using icloud.com domain for legit and hidden adresses is such a typical Apple strategy of holding their own users and "others" (ie. other web services, other users etc) hostage simultaneously. But at least here it is actually a good reason that works for the user.

HeavenFox 44 days ago | |

Case in point: many websites block all VPN except iCloud Private Relay. Thank you Apple!

consumer451 44 days ago | | |

Seriously, Apple is "big tech," but they are the only one that appears to give a crap about privacy at all. And really, they put a lot of money and effort into it.

We need to give kudos when they are due.

Apple's Private Cloud Compute should have won some kind of Nobel Privacy Prize, which for some reason does not yet exist.

vallerie 43 days ago | | |

Private Relay also works because it's on by default for everyone paying for iCloud (including everyone just on the 0.99/month tier for photo backup) - so Apple can use it across their apps (e.g. loading images in Apple Mail) and it doesn't let you single out privacy conscious users!

jeroenhd 44 days ago | | |

I don't think websites block Google's VPN either, although that's not quite as popular as Apple's VPN solution.

inigyou 43 days ago | | |

I worked at a place that was contractually mandated to block VPNs except iCloud Private Relay and we had a special exception in the code for this.

dilyevsky 44 days ago | |

how is the user being held hostage? you can redirect hide my email addresses to any domain

travoc 44 days ago | | |

Marketing turds can't just block registrations from all of @icloud.com.

aareet 44 days ago | | |

I think the other answers are misinterpreting your question. A user is held "hostage" because unlike fastmail where the format is word.salad@yourdomain; if you ever wanted to ditch iCloud completely, you'd have to go through every single account you used it for and update the email. As someone who has shed his gmail account I can tell you it's not easy to update email address on every site you've ever used it on. The issue people are raising is that apple doesn't let you use your own domain, and generate random emails at that domain. Not my complaint, but I can see the perspective.

NotThatFast 44 days ago |

One of the best things about it. Also being able to add several emails per custom domain for free.

Whole thing is 99c a month. Makes Gmail seem like a joke in comparison.

Until you get an email from an iCloud address on Gmail and see it go right to spam haha. Suddenly Gmail is cheap again

wafflemaker 44 days ago | |

Best thing to do with Gmail spam is to make an auto filter to mark all spam as not spam.

Took me only one missed dentist appointment several years ago to get that idea. Now I'm just getting profits. No other spam since I'm using email aliases.

dannyw 44 days ago | | |

Unfortunately you can only do that for yourself, your recipients almost certainly aren't doing the same. It doesn't address the "gmail deliverability" issue.

Quothling 44 days ago | |

Maybe it's because I live in a country where e-mai isn't really used that much for personal communication, but wouldn't this mainly be a gmail issue? If mails I wanted ended up in the spam folder I'd not use gmail. I mean, I pay for protonmail, so I wouldn't use gmail to begin with, but if mails I wanted ended up in my protonmail spamfolder and I couldn't do anything about it, then I'd switch away from protonmail.

NotThatFast 44 days ago | | |

You are 100% correct and yet the masses still prefer it.

World’s a twisted place!

I would guess the average Gmail user doesn’t know that it reports virtually all iCloud as Spam - believing instead that it’s genuinely being filtered by quality engineering at Google.

DrewADesign 44 days ago | | |

If you’re talking about people with the technical sophistication to consider software services based on their technical merits, then sure. Your average user couldn’t even tell you the first thing about which non-content-based criteria might inform a spam score… or have even heard of a spam score. So they will absolutely not blame Gmail if another provider’s email gets spam flagged… they’d probably just think “why don’t they just get a Gmail account,” à la iMessage users/green texts.

philip1209 44 days ago |

I wish I could set up "Sign in with Apple" on a blog without paying $99/yr for a developer license.

chanux 44 days ago | |

Is your audience very Apple heavy?

pasc1878 44 days ago | |

Why do you want this.

Is it a benefit to you? If it is why should you not pay for that benefit?

Nothing is free.

Jleagle 43 days ago | | |

You say nothing is free, but Amazon, Discord, Dropbox, Facebook, GitHub, Google, Instagram, Microsoft, Paypal, Reddit, Slack, Steam, TikTok, Twitter etc all offer it for free.

Plus, it's not for the dev, it's for the users of the website.

whstl 43 days ago | | |

It's mutually beneficial to everyone involved, Apple, the blog, the user.

No leaked email address, no need for anyone to store password, people using iCloud instead of Gmail.

What they're asking, for it to cost zero, sounds perfectly reasonable here.

sunaookami 44 days ago | | |

Since when did we start accepting that paying for providing OAuth sign-in for other companies is good?

joshuat 44 days ago |

I'm glad they listened - I use this feature extensively and would like to continue to

giwook 44 days ago |

Can someone explain the backstory behind this? I'm reading some of the comments here and I feel like I'm missing something here.

dannyw 44 days ago | |

For the "hide my email" feature, Apple currently and has always used "@icloud.com". This masks you amongst all iCloud users.

They were planning to change it to a custom domain, which would allow sites to easily filter out and reject "Hide my email" users based on the email.

They have now reverted their plans to change this, meaning "hide my email" is still "@icloud.com".

nailer 44 days ago | | |

I suspect many people actually feel better about Apple owning this fuckup and reversing it than they would have Apple hadn't fucked up in the first place.

frabcus 43 days ago | | |

Except the post says it will be @private.icloud.com

Whereas people's Apple emails are often at @icloud.com

So I don't think it masks you amongst all iCloud users. I'm confused how this is much better!

SXX 43 days ago |

Oh I glad there is still someone at Apple who understood its insanity. If only they made it generate a bit more sensible alias names.

UPD: I obviously mean alias addresses template make most of them too easy to recognize.

merlindru 43 days ago | |

Can't the aliases be renamed?

---

Just checked, they can. Phew. If the forwarding alias was detectable/always used the same schema, that'd also make them borderline useless, just like the `privaterelay` subdomain

SXX 43 days ago | | |

What do you mean renamed? Alias address certainly are not changeable. You can randomize next one from 2-3 options, but most of them still follow pattern that is easy to recognize.

PS: I guess its just misunderstsnding and I really meant addresses themself are not human-like enough.

simongr3dal 43 days ago | | |

But the private relay domain is only used when you sign up through “Sign in with Apple”? A thing you have to support if your iOS app already supports sign up with other third party authentication providers.

glub 42 days ago | |

Yeah, I don't really get the excitement. The pattern in which these aliases are generated might as well just end with private.icloud.com.

Is breest-tas.7n@icloud.com really that hard to detect as hide my email?

amazingamazing 44 days ago |

Good. What else can really be said? Only way for it to work and not be trivially blocked is to mix with legit emails.

jambalaya8 44 days ago | |

A lot of places also don't really like icloud addresses in general. This is one of Apple's better offerings though.

wijayaerick 44 days ago |

iCloud Hide My Email sharing the same domain with normal email (icloud.com) is the reason why I use iCloud over other email alias services like simplelogin and addy.

aucisson_masque 44 days ago |

Apple had been on a steady path of bad decisions since a few years, I'm glad to see they reverted at least on this one.

Now if they could completely remove liquid glass...

floam 44 days ago |

Good. This would have made blocking them trivial.

postalcoder 44 days ago |

I've noticed a chilling new trend of apple listening to the community.

VCFundedGenYer 44 days ago | |

My guess is Ternus is starting to take more and more control. Tim was pretty absent and phoning it in the past few years.

nate 44 days ago | |

Anyone have a theory why this even made it to this point? the switch was such obviously a bad idea. just corporate weirdness that no one there bothered to raise their hand and be like "uh, are we really doing this?" or was there a story here that anyone knows about?

jofzar 44 days ago | | |

It's email reputation, it the always the answer with this kind of stuff.

My guess is that the bounce rate got too high and bot farms were using iCloud addresses like this.

super256 44 days ago | | |

Maybe hidemyemail allows easily creating many accounts on a site. And some big site didn't like it.

The "Sign-up via Apple" button and creating an iCloud email yourself have a slightly higher barrier than creating a new throwaway hidemyemail email (1 API call w/o captcha/phone verification or whatever).

We might find out later this year if some site starts blocking @icloud.com but keeps allowing @private.icloud.com.

LgWoodenBadger 43 days ago | | |

Whoever operates the smtp servers for icloud.com complained loudly enough that their job was too hard because of all the traffic, but not loudly enough for someone smart enough to hear about it, until it was announced to the public.

cush 44 days ago | |

Hmm it’s almost as if people are paying good money for iCloud+ or something. They aren’t google and shouldn’t be retiring their services as if they’re giving them away for free

herpdyderp 44 days ago | | |

While I applaud this specific change, Apple has been known to stick to their guns and I used to believe they were almost always in the right for doing so because it led to better outcomes. So my take is that it's chilling because Apple has so lost their way that they can't figure out these obviously stupid directions internally before making a fool of themselves to the public (and I agree with that take).

srevenant 43 days ago |

Don't mix use cases. Privacy is different from uniquely identifying senders.

The reason for random email addresses is YOU finally can identify each vendor uniquely by the email they send you stuff.

It isn't about anonymizing, it's about identifying them.

I've been doing it for 30+ years on my own domains.

dundercoder 42 days ago | |

This is exactly what I use it for.

scosman 44 days ago |

it will still be on "private.icloud.com". Just as filterable...

ninkendo 44 days ago | |

private.icloud.com (née privaterelay.appleid.com) is the address for “Sign In With Apple”, which is an oauth-style service that sites opt into to let you use your Apple ID to sign in. Sites offering this as a signup option are already aware it gives users an option to use a private anonymized email address.

The toplevel “Hide My Email” iCloud feature is a different thing, can be done independently of a SIWA flow (you can just go into settings and make more addresses, all it needs is a name and a notes field) and uses @icloud.com in order to make your anonymized email address look indistinguishable from other iCloud users.

The former is “filterable”, yes, but it’s moot because you only get those if you offer Sign In With Apple in the first place, and if you want real emails, you would already know to just… not do that.

The latter is very much not filterable.

The confusing thing though, is that when a user uses Sign In With Apple, they are offered two options: “share my email” which gives the site your real address, and “hide my email” which gives an @private.appleid.com address. But this “hide my email” option is a totally different thing from the separate “hide my email” service, which lets you make arbitrarily many @icloud.com private aliases to forward to your real address. Critically, the latter toplevel Hide My Email feature works with sites that don’t use Sign In With Apple. It’s just stupidly unfortunate that Apple calls both of these features “hide my email.”

samschooler 44 days ago | | |

Agree with the comment largely; though: Apple does have a policy where apps need to use SIWA if other oauth providers are present (Google) [0]. So sites do "opt in" to this, but are forced by apple to use SIWA if they're using any other provider.

[0]: https://developer.apple.com/app-store/review/guidelines/#sig...

_ks3e 44 days ago | | |

Not arbitrarily many aliases - there's a limit of (as of two or three weeks ago) 768.

internet2000 44 days ago | |

It won't. The news here is that it won't.

mococa 43 days ago |

If you pay for iCloud + a domain, you can have ${anything}@${yourdomain}. Works like a charm.

For example, I can have hn@mydomain.com for hn only mails, if they share my mail address, I'll know.

glub 42 days ago | |

You also make yourself extremely identifiable. It takes only one leak to know that all emails on mydomain.com across the web are delduca.

bni 44 days ago |

As I user of this service I like this.

However filtering for these hide my e-mail addresses is quite easy if you are motivated to do it, they have a recognizable pattern.

Keirmot 44 days ago | |

They do, but then your net can get false positives. Even if unlikely, someone can have the email potent-tomatoq4@icloud.com

Mindwipe 43 days ago |

Good. Thank you for listening, iCloud team.

etaioinshrdlu 44 days ago |

I'm a bit confused - when i see these signups, they look like this to me:

rtwnj6tj7@privaterelay.appleid.com

anon7000 44 days ago | |

I think the post is very explicit. First sentence:

> Starting later this year, new Sign in with Apple addresses, previously issued on privaterelay.appleid.com, will be issued on private.icloud.com. Existing addresses on privaterelay.appleid.com will continue to work and forward mail to users without interruption.

jshier 44 days ago | | |

That's the Sign in with Apple domain, not the Hide My Email domain. HME is remaining at icloud.com instead of moving to private.icloud.com as well. From the linked article:

> After further consideration and reviewing community feedback, iCloud+ Hide My Email addresses will remain on icloud.com.

drdexebtjl 44 days ago | |

How many sign ups you have with an @icloud.com address?

A lot of those are Hide My Email aliases that, by design, you can’t tell apart from real human addresses.

xaviervn 44 days ago |

I don't understand how this changes anything. IIRC, the complaints were about Apple making the Hide My Email addresses different than regular ones.

They're now saying the new domain will be private.icloud.com. Isn't it just as targetable?

LoganDark 44 days ago | |

Sign in with Apple is Apple's SSO, like Sign in with Google. Services have to support this one explicitly, and it already had a special subdomain, so the specific subdomain is simply changing.

Hide My Email is the manually generated ones, for websites that accept an arbitrary email address. This is the one where it's valuable for the relays to be identical to genuine iCloud addresses, otherwise websites could try to block it and force you to use a more revealing email address, undermining privacy.

NobodyNada 44 days ago | |

It's talking about two different services:

> Sign in with Apple addresses, previously issued on privaterelay.appleid.com, will be issued on private.icloud.com.

> iCloud+ Hide My Email addresses will remain on icloud.com.

Vinnl 44 days ago |

I wonder if the initial reason to move them to a separate domain, was because they started to see providers blackholing icloud.com anyway, thus also hurting non-aliased emails?

If so, will be interesting to see if that will get worse.

tingletech 44 days ago |

this opens some crazy "apple developer" dialog on my mac rather than a web page. I had to crank up chrome to read it. And it makes no sense, I have no clue what a sign on with apple address is. I guess I'm glad my hide my email addresses won't change because that would be a PITA.

ezfe 44 days ago | |

You have the developer app installed. It does seem to be deep linking wrong.

prism56 44 days ago |

Good! Was there ever a compelling reason why they went for this switch initially?

floam 44 days ago | |

Yes, to fully fix a certain class of bug on their infra.

culi 44 days ago | | |

Do you know any more about it or have a link where I can read more?

ozereray1 43 days ago |

It is reassuring to see Apple maintaining this domain consistency. Changing it would have broken a lot of automated routing rules for those of us relying on it for privacy.

mococa 44 days ago |

That was a stupid idea (the prev one)

rubyfan 43 days ago |

Now if they would only figure out how to Hide My Phone Number then these feature would actually impact privacy.

1vuio0pswjnm7 43 days ago |

01 Jul 2026 10:19:45 UTC | Apple 'Hide My Email' vulnerability reveals peoples' real email addresses | https://www.404media.co/apple-hide-my-email-vulnerability-re... | https://news.ycombinator.com/item?id=48744606

02 Jul 2026 03:47:04 UTC | Apple 'Hide My Email' Vulnerability Reveals Peoples' Real Email Addresses | https://www.404media.co/apple-hide-my-email-vulnerability-re... | https://news.ycombinator.com/item?id=48756295

03 Jul 2026 22:56:51 UTC | Apple 'Hide My Email' Vulnerability Reveals Peoples' Real Email Addresses | https://www.404media.co/apple-hide-my-email-vulnerability-re... | https://news.ycombinator.com/item?id=48780999

04 Jul 2026 17:01:39 UTC | Security Roundup: Apple's Hide My Email Service Fails to Hide Your Email | https://www.wired.com/story/security-roundup-apples-hide-my-... | https://news.ycombinator.com/item?id=48786928

04 Jul 2026 18:54:24 UTC | Apple Hide My Email Reveals the Users Real Email | https://www.404media.co/apple-hide-my-email-vulnerability-re... | https://news.ycombinator.com/item?id=48787842

05 Jul 2026 06:26:38 UTC | Security Roundup: Apple's Hide My Email Service Fails to Hide Your Email | https://www.wired.com/story/security-roundup-apples-hide-my-... | https://news.ycombinator.com/item?id=48791735

07 Jul 2026 02:16:06 UTC | Apple 'Hide My Email' Vulnerability Reveals Peoples' Real Email Addresses | https://www.404media.co/apple-hide-my-email-vulnerability-re... | https://news.ycombinator.com/item?id=48812946

12 Jul 2026 01:05:37 UTC | Apple Hide My Email bug, possibly related to disclosure vulnerability | https://lapcatsoftware.com/articles/2026/7/2.html | https://news.ycombinator.com/item?id=48877353