Sign in with Apple relay addresses moving to private.icloud.com later this year

Apple is moving relay sign-ins to a new domain

Apple has told developers that Sign in with Apple relay email addresses are switching domains. In a notice dated August 24, 2026 and published on Apple's developer news page, where it circulated on Hacker News's front page, the company says that "later this year" newly issued relay addresses will use private.icloud.com instead of the privaterelay.appleid.com domain Apple has issued them on until now.

The change applies only to new addresses. According to Apple, existing privaterelay.appleid.com addresses will keep working and will keep forwarding mail to users' real inboxes uninterrupted. There is no migration for people who already signed up with an older relay address, and no action is expected from end users.

Hide My Email is staying put

The same notice also settles a related question. Apple says that, following a rethink prompted by community feedback, iCloud+ Hide My Email addresses will stay on icloud.com. The wording implies the company had been weighing a domain change for the subscription feature's forwarding addresses and has decided against it.

The two features overlap but are distinct: Sign in with Apple offers users of apps and websites a relay address that hides their personal inbox, while Hide My Email is the iCloud+ feature for generating forwarding addresses on demand. With this update, only the Sign in with Apple relay changes domain.

What developers need to check

Apple's guidance is short but consequential. Teams running apps or websites that offer Sign in with Apple are told to make sure three areas accept addresses on private.icloud.com in addition to the existing domain:

• Account systems that store or match the email addresses attached to Apple sign-ins.
• Email validation logic, for example format checks that only recognise domains they have seen before.
• Allowlists that control which addresses or domains can register, log in, or receive messages.

The fix in each case is additive rather than a switchover: both domains must be treated as valid from the moment the new one goes live. Because Apple says the old domain continues to function, services will run in a mixed state, with some users on privaterelay.appleid.com and new users on private.icloud.com, for an open-ended period. Apple also points developers to its existing documentation on communicating through the Private Email Relay Service for further detail.

Why it matters

The failure mode here is quiet and easy to miss. If a sign-up form, API validator, or mail filter rejects private.icloud.com, new users who choose the privacy option will hit errors at registration or never receive confirmation mail, and the root cause — a vendor domain that few developers consciously hardcode — is not an obvious place to look. Because these addresses exist to shield real inboxes, breakage either pushes users toward revealing personal email addresses as a fallback or loses sign-ups outright.

The loose timing compounds the risk. Apple has given only a "later this year" window with no fixed cutover date, so any validation that discovers the new domain in production will fail unpredictably rather than on a scheduled day. Searching code, configuration, and mail infrastructure now for everywhere privaterelay.appleid.com appears is cheap insurance.

The Hide My Email reversal is the quieter half of the story, but it is a useful signal. Apple explicitly credits user feedback for keeping iCloud+ addresses on icloud.com, which suggests the company does respond to developer pushback on domain changes, even as it proceeds with the one it considers necessary. For developers, the practical takeaway is to watch Apple's developer news feed closely: this class of change arrives as a brief notice with a vague deadline, and it lands hardest on whoever did not happen to read it.