Emails to Apple "Hide My Email" addresses (privaterelay.appleid.com)

What it means

When someone uses Sign in with Apple on your app or website, they can choose "Hide My Email". You then receive a random address such as abc123xyz@privaterelay.appleid.com. Apple forwards emails sent to it to the person's real inbox.

iCloud+ users can also create "Hide My Email" addresses by hand, for example on a sign-up form. Those are usually on @icloud.com and work like normal addresses.

Why it matters

• For Sign in with Apple relay addresses, Apple accepts emails only from domains and addresses you have registered in your Apple Developer account. Other emails are refused.
• Apple also checks that your emails pass SPF and are signed with DKIM. Unauthenticated emails can bounce.
• Users can turn forwarding off at any time. Emails then bounce or disappear, and you should stop sending to that address.
• If these addresses bounce a lot, your overall bounce rate rises and hurts your reputation.

How to check

• Look at your bounces for @privaterelay.appleid.com addresses. A rejection message that mentions the relay or an unregistered sender points to this problem.
• Send a test email: on the home page, copy your unique test address, send it a normal email from the mailbox or tool you want to check, then open the report. Use the same tool and From address that you use for your app users. SPF and DKIM should both pass for your domain.
• Use the Domain scanner: type your domain at /domain-scanner to check SPF, DKIM and DMARC records.

How to fix it

1. Authenticate your sending domain. Make sure SPF includes your sending service and DKIM is set up with your own domain. Add a DMARC record too.
2. Open your Apple Developer account and go to the settings for Sign in with Apple. Apple calls this the "private email relay service" configuration.
3. Register your sending domains and addresses. Add each domain you send from (for example yourdomain.com or mail.yourdomain.com) and each From address (for example hello@yourdomain.com). Apple checks the domains using SPF.
4. Use the same From address that you registered in every tool that emails these users: your app backend, newsletter tool and support desk.
5. Handle bounces. When a relay address bounces several times, the user probably disabled forwarding. Stop sending to it and, if possible, ask the user in your app for a new contact address.

Apple's official instructions: Configure private email relay service.

Good practice

• Never try to guess or ask for the user's real address to bypass the relay. The person chose privacy.
• Treat relay addresses like any other: send only emails the person expects, with an easy unsubscribe link.

Check that it is fixed

DNS changes are not instant. Most are visible within a few minutes, but some providers take up to 24 to 48 hours.

Send a new test email from the home page with the registered From address: SPF and DKIM should pass for your domain. Then sign in to your own app with Apple, choose "Hide My Email", trigger an email and check it arrives in your Apple mailbox.