Apple Keeps Hide My Email on iCloud.com—but Sign in with Apple Is Still Moving

Apple has abandoned the planned move of new iCloud+ Hide My Email aliases from @icloud.com to @private.icloud.com. After reviewing community feedback, the company said Hide My Email will continue using @icloud.com, the same domain used for standard iCloud email. The separate migration of new Sign in with Apple relay addresses will still go ahead. 181924

What Apple changed

Apple’s original June announcement proposed one shared domain for both privacy features: @private.icloud.com. Under that plan, new Hide My Email aliases would have moved from @icloud.com, while new Sign in with Apple addresses would have moved from @privaterelay.appleid.com. Existing addresses were expected to continue working and forwarding mail without interruption. 17

The revised plan splits the services again:

• Hide My Email: New aliases will remain on @icloud.com; the proposed migration to @private.icloud.com is cancelled. 1819
• Sign in with Apple: New relay addresses will still transition from @privaterelay.appleid.com to @private.icloud.com. 1819
• Existing addresses: Apple’s stated transition policy is that legacy addresses will continue to function and forward mail. Developers and email providers must account for the new Sign in with Apple domain rather than rejecting it as an unknown address. 1725

Why users objected to @private.icloud.com

The central concern was not that the alias would stop forwarding mail. It was that moving Hide My Email to a clearly labelled privacy domain would make those addresses more identifiable.

Hide My Email aliases currently use the same @icloud.com domain as ordinary iCloud addresses. That makes it difficult for a service to selectively reject privacy aliases without also risking ordinary iCloud users. A dedicated @private.icloud.com domain would allow a website or mail administrator to identify the aliases with a simple domain-level rule, potentially making them easier to block or treat differently. 2429

That distinction matters because Hide My Email is intended to let people use a different address for each service while keeping their real inbox private. Users and developers therefore viewed the proposed domain change as a possible reduction in practical privacy—even though the forwarding mechanism itself was not being removed. 1821

What the decision means for each Apple feature

Hide My Email stays on @icloud.com

People creating new iCloud+ Hide My Email aliases should continue to receive addresses using the familiar @icloud.com domain. The planned issuance of new aliases on @private.icloud.com will not happen under Apple’s revised policy. Existing aliases also remain part of the legacy-address forwarding arrangement described by Apple. 1718

Sign in with Apple still moves to @private.icloud.com

The reversal applies only to the Hide My Email portion of the plan. Sign in with Apple will still issue new private relay addresses on @private.icloud.com instead of @privaterelay.appleid.com. Existing Sign in with Apple relay addresses are intended to keep working and forwarding mail, but services that validate or filter email domains should be prepared to accept the new domain. 1725

For users, this means the two Apple privacy features will no longer converge on one domain: Hide My Email remains associated with @icloud.com, while new Sign in with Apple addresses adopt @private.icloud.com.

How the reversal relates to recent privacy concerns

Apple has not publicly said that the domain reversal was caused by the recent security reports. The connection is timing and user confidence, not an established technical or causal link.

In July, reports described a Hide My Email flaw in which sending a message to an alias that was rejected as spam could expose the underlying real email address in delivery or sender logs. Apple said a patch deployed on July 3 fully resolved the issue, and subsequent testing reported that the flaw could no longer be reproduced, although reporting around the timing of the fix was disputed. 353948

Separate research also found that some WebKit behaviors could bypass iCloud Private Relay. The reported paths included passkey-related WebAuthn requests, DNS prefetching, and WebTransport connections that could send traffic outside the expected proxy route and expose a user’s real IP address to a website. 1414

Those findings concern different systems: the Hide My Email report involved email routing and bounce handling, while the Private Relay findings involved IP and DNS protection. Neither demonstrates that the domain change would itself create the same vulnerabilities. But together they explain why users were especially sensitive to a proposal that could make privacy aliases easier to identify.

The practical takeaway

Apple’s reversal preserves the most important property users wanted from the existing Hide My Email setup: new aliases will not be moved onto a domain that clearly labels them as private relay addresses. Sign in with Apple, however, still requires a domain transition, so developers should treat @private.icloud.com as a valid new relay domain and continue supporting legacy addresses during the transition. 1725