Apple’s New Hide My Email Domain Makes It Easier to Block iCloud Aliases

Apple’s decision to move Hide My Email to a dedicated “private.icloud.com” domain appears to have the consequence of making it easier for platforms that want to block iCloud aliases to do so.

Apple is unifying the email domains used by Sign in with Apple and ‌iCloud‌+ Hide My Email under a single private.icloud.com domain later this summer. Sign in with Apple currently uses privaterelay.appleid.com, while Hide My Email uses icloud.com, the same domain as standard ‌iCloud‌ email addresses.

That shared domain has historically made it difficult for services to selectively block disposable ‌iCloud‌ addresses. Blocking icloud.com outright would also block legitimate users with standard Apple email accounts. With the new subdomain, that tradeoff disappears.

@vxdb on X was among the first to flag the implication: “platforms who want to ban ‌iCloud‌ aliases can now do so by banning this new subdomain without affecting all ‌iCloud‌ users.” Others online noted that email services, signup flows, and anti-abuse systems will now have a clean, unambiguous target if they choose to restrict alias-generated addresses.

Apple has said that existing addresses on legacy domains will continue to work and that mail will be forwarded with no interruption, so current Hide My Email users won’t lose access to their aliases. New addresses generated after the migration, however, will feature the private.icloud.com domain, and it is those addresses that become blockable in isolation for the first time.