Sign in with Apple moves to private.icloud.com — fix validation

Apple reversed one domain change this week and kept the other. iCloud+ Hide My Email addresses will stay on icloud.com. Sign in with Apple relay addresses are still moving to private.icloud.com later this year. If your signup flow validates email domains — and most checkout and account systems do somewhere, usually in a regex nobody has read since it was written — the second half of that sentence is a bug with a delivery date on it.

What actually happened

In June, Apple announced that both Sign in with Apple and iCloud+ Hide My Email addresses would consolidate onto a new private.icloud.com domain. Hide My Email currently shares icloud.com with ordinary iCloud mailboxes, which is exactly what makes the aliases hard to block — you cannot reject them at the domain level without rejecting real customers alongside them. Splitting them out would have made alias-blocking a one-line rule.

Apple backed off that half. Per its updated developer note, after "reviewing community feedback," Hide My Email addresses remain on icloud.com. 9to5Mac and AppleInsider both confirmed the reversal on August 24.

The part that did not change: new Sign in with Apple addresses, previously issued on privaterelay.appleid.com, will be issued on private.icloud.com starting later this year. Existing privaterelay.appleid.com addresses keep working and keep forwarding. Apple's instruction to developers is direct — account systems, email validation logic, and allowlists need to accept the new domain in addition to the old one.

Why this email domain change matters for your business

A rejected signup is a silent conversion loss. Nobody files a support ticket saying "your form said my email was invalid." They close the tab. If your validator has an allowlist, an anti-disposable-email check, or a fraud rule keyed on relay domains, a customer signing in with an iPhone in Q4 hits a wall you will not see in your error logs — you'll see it as a flat conversion rate.

Check the places you forgot you validate. It is rarely one function. It's the checkout form, the CRM import rule, the Klaviyo suppression list, the fraud vendor's config, the Zapier step someone built in 2024, and the ESP that quietly bounces unknown domains. Grep your codebase for privaterelay.appleid.com and then go look at the SaaS dashboards where the same string is typed into a settings box.

Hide My Email staying on icloud.com is a decision about you, not just users. Apple looked at making privacy aliases trivially blockable by merchants and declined. Plan for masked addresses to remain indistinguishable from real ones — build the deliverability and lifecycle handling that assumes you cannot tell the difference, because you can't.

Sources: Apple Developer, 9to5Mac, AppleInsider.