Apple Hide My Email Domain Change: Implications for User Privacy and Service Integration
Apple is transitioning its Hide My Email and Sign in with Apple aliases to a unified domain: @private.icloud.com. This change allows website operators to easily identify and block all relay addresses, which potentially undermines the same privacy protections the feature provides.
The Shift to @private.icloud.com
Apple's Hide My Email service allows users to create unique, random email addresses that forward messages to their primary iCloud mail account. Previously, these aliases were issued on various domains, including @icloud.com and @privaterelay.appleid.com.
Now, both Sign in with Apple and Hide My Email aliases are being consolidated consolidated into the @private.icloud.com subdomain. This consolidation makes it easier for services to implement blanket bans on all relay addresses without affecting legitimate, non-relay @icloud.com mailboxes.
Impact on User Privacy and Service Accessibility
The primary concern among technical users is that a dedicated domain for relay addresses makes them trivial to block.
The Risk of Blanket Bans
If a service provider decides to block sign-ups from @private.icloud.com addresses, users will be unable to use Hide My Email for that specific service. While some argue that this is a strategy to prevent burner accounts, some users believe this change is effectively "useless" because it easier for sites to target the privacy-focused users.
The SSO Trade-off
Because Sign in with Apple (SSO) also uses this domain, services that block @private.icloud.com would effectively be blocking the ability to use Apple's Single Sign-On ecosystem. This may deter some providers from blocking the same domain, as cutting themselves off from the Apple ecosystem could lead to their apps being pulled from the App Store or violate Apple's requirements for using the SSO service.
Technical Limitations of Hide My Email
Beyond the domain change, some users have highlighted fundamental UX and technical flaws in the current Hide My Email system:
Third-Party Communication Failures: Because services must pre-register how they will send email, third-party relationships (such as payment processors or shipping companies) often fail to send notifications to relay addresses, resulting in users missing critical invoices or shipping updates.
Account Recovery and Management: Users often struggle to remember which specific random alias was used for a specific service, making it impossible to sign in on the web or recover accounts when not using the iPhone interface.
Alternatives to Apple's Relay Service
For users concerned about the ecosystem lock-in or the blockability of the community-driven domains, the community suggests several alternatives:
Custom Domain Catch-alls: Purchasing a cheap domain and setting up a subdomain catch-all that forwards all mail to a primary address (e.g.,
service@mailsub.example.com$\rightarrow$user@gmail.com).Dedicated Alias Providers: Services like SimpleLogin, Fastmail, and Proton aliases are recommended for their better integration with password managers and the ability to use custom domains to avoid provider lock-in.
Coded Solutions: Advanced users have implemented custom scripts (e.g., using Postfix) to create temporary, date-specific email addresses that automatically expire after 24 hours.