AppSec · 87 days ago
Apple is collapsing two privacy relay systems onto one new domain, and that creates a single place where overzealous allowlists and mail filters can break both sign-ups and forwarding at once. The risk is not account takeover. It is a quiet outage for legitimate Apple-authored addresses when a site or mail platform has not updated its domain rules.
New addresses from Sign in with Apple and Hide My Email will use private.icloud.com later this summer. Apple says existing privaterelay.appleid.com and icloud.com addresses will keep working, and it is telling developers and email providers to update account validation, allowlists, suppression lists, filtering, and routing to accept the new domain.
3 sources covering this story
Apple's Hide My Email tweak leaves privacy fans fuming
A few days ago, Apple quietly announced what might have seemed like a minor change to one of its most popular privacy features - and has left some users feeling that the company is pulling the rug from underneath them.
Apple is bringing Hide My Email and Sign in with Apple under one domain - Help Net Security
Apple is unifying the email domain used by Sign in with Apple and Hide My Email, moving new addresses to private.icloud.com
In the coming weeks, Apple will move anonymously generated emails addresses to a different domain.
Part of the PlainSec briefing for 2026-06-19