Apple Moves 'Sign in with Apple' Relay Addresses to New Domain

Apple is updating the infrastructure for its privacy-focused email relay services, changing the domain used for automated account creation. The move creates a clearer technical distinction between the company's single sign-on (SSO) tools and its subscription-based alias service.

According to an announcement from Apple Developer, relay addresses issued through the "Sign in with Apple" service—which previously utilized privaterelay.appleid.com—will now be issued on private.icloud.com. However, this change does not apply to all privacy emails; manually generated "Hide My Email" addresses provided via iCloud+ will continue to use the standard icloud.com domain.

The Privacy Ecosystem

To understand the shift, it is necessary to distinguish between Apple's two primary email masking features. "Sign in with Apple" is an automated SSO service that generates a unique relay address for a specific app or website during the registration process. In contrast, "Hide My Email" is a manual tool for iCloud+ subscribers, allowing them to create random addresses for any service they choose. Both systems function by forwarding incoming mail to the user's actual inbox without exposing their primary email address to the third party.

Strategic Isolation

This domain split reflects a balance between technical isolation and user utility. By keeping manual "Hide My Email" addresses on the primary icloud.com domain, Apple ensures these aliases remain indistinguishable from genuine iCloud accounts. This prevents third-party websites from easily identifying and blocking privacy-focused addresses, which would otherwise hinder the utility of the subscription service.

Meanwhile, moving the SSO-driven relay to the dedicated private.icloud.com domain allows Apple to better manage the infrastructure of the automated ecosystem. This separation likely improves security and infrastructure management for the high-volume, automated traffic generated by the "Sign in with Apple" framework.

What to Watch

Developers integrating Apple's identity services should ensure their systems recognize the new private.icloud.com domain to avoid delivery failures or registration errors. While the core functionality of the relay remains unchanged for the end user, the shift signals Apple's ongoing effort to refine how it handles identity masking at scale. It remains to be seen if Apple will further segment these domains as more privacy features are integrated into the iCloud+ suite.