Apple Is About to Make Hide My Email Easy to Block

On June 15, 2026, Apple published a short developer note that, read carefully, redraws the line between a private email alias and a blockable one.

A quiet announcement with a loud consequence

The note was titled "New domain for Sign in with Apple and iCloud+ Hide My Email." In it, Apple confirmed that later this summer the company will unify the email domains used by two separate privacy features under a single shared domain, private.icloud.com. The framing in the announcement is housekeeping. Two relay systems, one cleaner name. For most readers of a developer changelog, the line would slide past as routine maintenance.

It is not routine. Until now, Hide My Email aliases, the random forwarding addresses that iCloud+ subscribers generate to keep their real inbox out of the hands of marketers, were issued on the ordinary @icloud.com domain. That is the same domain used by millions of regular iCloud Mail accounts. Sign in with Apple aliases lived on a different address, privaterelay.appleid.com. Going forward, new addresses for both features will be issued on @private.icloud.com. Three relay domains are now in play at once, and only one of them is the new dedicated label.

The mechanical effect of moving every alias onto its own subdomain is that any website can now identify a Hide My Email address at a glance. The mask, in other words, just got a label sewn onto it.

How the camouflage worked, and why it stops working

Hide My Email was introduced as part of iCloud+ to solve a small but persistent problem of modern life: signing up for anything online forces you to hand over a real email address, which then gets sold, leaked, and spammed. The feature mints unique, random-looking addresses that forward quietly to a user's real inbox. The real address is never shared with the app, the website, the newsletter, or the form.

Its quiet strength was always the domain it lived on. Because old Hide My Email aliases sat on plain @icloud.com, a website could not tell an alias apart from a regular iCloud user. To refuse one was to refuse the other. A retailer that wanted to block burner addresses had to be willing to slam the door on every grandparent with an @icloud.com account, and almost none of them were willing to do that. The camouflage was the feature.

Moving every alias onto a dedicated @private.icloud.com subdomain breaks that camouflage. Each address becomes instantly identifiable as a relay. Any service that wants to reject them can do so with a single rule, the same technique services already use to reject disposable or temporary email providers. The developer Arseniy Shestakov, who was first to flag the change publicly, put it plainly in his June 16, 2026 write-up. "This makes it much easier to ban all aliases without affecting non-relay mailboxes on iCloud mail," he wrote, calling the shift "a big hit for iCloud privacy."

Apple declined to comment publicly on the reasoning behind the move, according to TechCrunch, which reported on the change on June 16, 2026.

The instruction sheet cuts both ways

Embedded in the same developer announcement is the practical detail that turns the change from a theoretical risk into an immediate one. Apple told developers, in its own language, that they "should ensure that their account systems, email validation logic, and allowlists accept addresses on the new private.icloud.com domain in addition to existing domains." It told email service providers to update any domain-based filtering, suppression lists, or routing rules that enumerate relay domains so the new domain is included.

For a legitimate developer building a sign-up flow, that guidance is helpful. It tells you what string to add to your allowlist so that customers who choose to mask their address can still complete the form. For anyone running in the opposite direction, the same line is a gift. The instruction sheet that helps friendly developers accept the domain hands every other site the exact string to deny. There is no ambiguity to research, no pattern to reverse engineer. The domain has a name, and the name is in Apple's own documentation.

Apple has been clear that nothing already issued will stop working. "Existing addresses on the legacy domains will continue to work and forward mail to users without interruption," the company wrote. Aliases minted before the change, on the old @icloud.com and privaterelay.appleid.com domains, will keep forwarding mail. The breakage, if it comes, is forward-looking. It is the new aliases, the ones a user generates after the switch flips, that arrive at a sign-up box pre-marked as relays.

What this changes for the feature in practice

It is worth being precise about what Hide My Email is, and what it is not, before reaching for conclusions. The feature is available in a limited free form to anyone using Sign in with Apple, and in a broader general-purpose form to paying iCloud+ subscribers. Users can mint aliases at a rate limited to at least 30 per hour. The paid tier starts at $0.99 a month for 50 GB of storage and rises to $2.99 a month for 200 GB, $10.99 a month for 2 TB, and $32.99 a month for 6 TB. iCloud+ Family Sharing covers up to 6 people total, the subscriber plus 5 others, and bundles the email tool alongside iCloud Private Relay and Custom Email Domain.

Adoption of the masking idea is not negligible. In one analysis of sign-in traffic, Gmail accounted for 51.6 percent, Apple's Private Relay aliases for 19.3 percent, and plain iCloud for 5.4 percent. Roughly 20 percent of users choose to hide their email when Sign in with Apple offers the option. That is a meaningful share of people who, at the moment of sign-up, decided they did not want to give the website on the other side of the form their real address.

After the switch, those same people will still be able to generate a fresh alias. They will still be able to send and receive on it. What they may find, in increments, is that more sign-up forms quietly refuse the address before the account is ever created. The masked alias still exists. Whether a site is willing to take it is now a one-line decision somebody else gets to make.

A privacy tool that just got a name tag

Apple has framed the shift as housekeeping, a tidy-up that merges two relay systems under a single domain, and there is a reading of the change in which that is exactly what it is. The company has not said it is trying to retire the feature, and its public guidance asks developers to keep accepting the new domain. The legacy aliases keep flowing. The product page still lists the protections that come bundled with iCloud+.

Early users discussing the change online warned it would make the service harder to rely on, because sites can now refuse the alias at sign-up. That is the quiet shape of the story. A privacy tool built to be invisible has, at the domain level, been made obvious. Anything obvious can be filtered. The mask still works, until the moment a website learns to recognize it.

Sources

• Apple Developer, New domain for Sign in with Apple and iCloud+ Hide My Email (June 15, 2026)
• TechCrunch coverage of the domain change (June 16, 2026)
• Arseniy Shestakov write-up on the new private.icloud.com domain