What is privaterelay.appleid.com? Apple's relay addresses explained for site owners

An address that ends in @privaterelay.appleid.com comes from Sign in with Apple. When a person signs up and picks Hide My Email, Apple gives your site a random address that forwards to their real inbox. A real person reads what arrives, and each person has one such address per developer team. Accept these addresses, register your sending domain with Apple so your mail gets through, and expect new ones on private.icloud.com later in 2026.

#Where do privaterelay.appleid.com addresses come from?

Sign in with Apple lets people create an account without sharing their email. If they choose Hide My Email, Apple generates "unique, random email addresses that automatically forward to your personal email inbox" (Apple Support). Your site receives the relay address, and the person keeps their real one private.

Apple's developer documentation lists how these addresses behave. They route mail to one of the verified addresses of the person's Apple Account. They stay the same for that person across all apps of one developer team. They keep working whether or not your app is still installed.

You will see them most in apps for Apple devices. App Store rule 4.8 says an app that offers a third-party login, such as Google or Facebook, must also offer one that lets people "keep their email address private" (App Store Review Guidelines).

#How does Apple's relay pass on your email?

1. Your server sends to the relay address, from an address or domain you registered with Apple.
2. Apple checks the sender. You must register your outbound addresses or domains and publish SPF, so that "only you can communicate with your users through this channel" (Apple developer docs).
3. Apple forwards the message to the verified email of the person's Apple Account.
4. When the person replies, the reply travels back through the relay, so your side never sees their real address.

Each relay address takes at most 100 emails a day, counting your messages and the person's replies. If the person stops email from your app, the relay "rejects all future emails sent to that address" (Apple developer docs).

#What changes in 2026?

Apple is moving new addresses to a second domain. On June 15, 2026, it announced that Sign in with Apple and iCloud+ Hide My Email would share one domain, private.icloud.com. On August 24, it narrowed the plan. iCloud+ Hide My Email stays on icloud.com, and new Sign in with Apple addresses move to private.icloud.com "later this year" (Apple Developer News).

Existing addresses on privaterelay.appleid.com keep forwarding mail. Apple asks developers to check that their "account systems, email validation logic, and allowlists" accept both domains. Both already receive mail: on October 23, 2026, the old domain listed four mail servers and the new one listed one (DNS lookup through Google Public DNS).

Hundreds of people a month look up the old domain, and almost nobody searches for the new one yet. Expect questions about private.icloud.com once the new addresses reach your signups.

#Should you block privaterelay.appleid.com addresses?

No. A relay address forwards to the verified inbox of a real Apple Account, which a throwaway inbox never does. Apple keeps the address the same for that person across all apps of one developer team, so it is a poor tool for making many accounts.

Blocking these addresses also breaks your own login. Apple tells developers to accept relay addresses in their validation and allowlists (Apple Developer News). An app that offers Sign in with Apple and then refuses its addresses turns away the people who chose privacy.

Judge the signup by its other signals instead, such as the IP address it came from. The same checks you run on any signup apply (how to stop fake signups).

#What is it often confused with?

iCloud Private Relay shares the word relay and nothing else. It sends Safari traffic through two relays, and the second one gives you a temporary IP address (Apple Support). An iCloud+ Hide My Email address ends in icloud.com, so it looks like any other iCloud address.

#How can you check an address yourself?

Look at the domain first: privaterelay.appleid.com or private.icloud.com means a Sign in with Apple relay. In code, an email check API gives the same answer. This is FFraud's answer for a made-up relay address on October 23, 2026, at 08:57 UTC, with some fields left out:

curl https://api.ffraud.com/public/email/check \
  -H "Content-Type: application/json" \
  -d '{"email":"[email protected]"}'

Read email_type, which says alias, and keep the address. On that day the same answer also set is_disposable to true for this domain, and FFraud's disposable email domains list included it. Code that blocks on either one turns away Apple users. The new private.icloud.com domain came back as email_type: normal the same morning.

An email verifier will not settle the question either. Apple accepts mail for these addresses only from senders the developer registered. Emailable's documentation, for one, marks them Undeliverable for that reason (read October 2026).

#What should your site do with them?

• Accept privaterelay.appleid.com and private.icloud.com in your email validation and allowlists.
• Register your sending addresses or domains in your Apple Developer account and publish SPF, or your mail is refused.
• Keep each relay address under Apple's limit of 100 emails a day.
• Register a server-to-server notification endpoint. Apple then tells you about "changes in email forwarding preferences" and account deletions (Apple Developer News).
• Treat a bounce from the relay as forwarding turned off, not as a fake account.
• Score the signup on its other signals, as you would any other.

#Questions people ask

For the other forwarding services, such as DuckDuckGo and Firefox Relay, read email aliases and Hide My Email.