Apple switches Hide My Email aliases to private.icloud.com domain

The change routes both relay services onto a single subdomain. Services can now maintain a single blocklist entry that covers every new alias without touching ordinary @icloud.com mailboxes. Prior architecture mixed relay and native addresses on the same domain, raising the cost of blanket blocks because legitimate iCloud users would be affected.

Apple’s update document contains no stated rationale or user impact assessment. Rate limits remain at 30 aliases per hour, giving current subscribers a short window to mint @icloud.com addresses before the subdomain switch lands. Coverage of the announcement has focused on the mechanics and omitted the structural removal of plausible deniability that previously deterred mass blocking.

The move aligns with broader platform patterns that favor deliverability and abuse prevention over user-controlled anonymity. Comparable shifts occurred when major providers isolated their own relay domains; block rates rose sharply once the cost to receivers fell. No public telemetry on alias usage or blocking incidents has been released by Apple.

Existing aliases continue to function. New services are expected to adopt the blocklist within weeks of the first observable private.icloud.com addresses appearing in the wild.