Short answer: an Apple Hide My Email address is a real subscriber, but Apple only forwards mail to it if your sending domains are registered with Apple and your messages pass SPF and/or DKIM. If you skip that step, those subscribers can bounce even though they opted in.
Most list-quality advice is about mistyped or abandoned addresses. This problem is different. The address is valid, the person wants your email, and your message can still fail because Apple does not yet know who you are.
What is an Apple Hide My Email address?
Apple's support documentation describes Hide My Email as a feature that generates unique, random email addresses that automatically forward to a person's personal inbox. Each address is unique to the person.
There are two ways a subscriber ends up with one:
- Sign in with Apple. If your app or website supports it and the person chooses to hide their email, the address is created on
@private.icloud.com or @privaterelay.appleid.com.
- iCloud+. Subscribers with an iCloud+ subscription can also create Hide My Email addresses themselves and type them into your sign-up form.
Apple states that only the app or website the person created the account with can use that address, and that only emails sent from designated sending addresses are forwarded. It also says it does not read or process message content apart from standard spam filtering, and that messages are deleted from its relay servers after delivery, usually within seconds.
What Apple requires from senders
Apple's developer documentation on the private email relay service sets out four requirements.
| Requirement |
What it means in practice |
| Register your sources |
Add every domain and subdomain you send from, or individual sending addresses, in the Sign in with Apple for Email Communication settings |
| Authenticate |
Mail must pass SPF and/or DKIM. Apple recommends both where possible |
| Match exactly |
For SPF, the registered domain and the envelope sender domain must match exactly. For DKIM, the signing domain must match the From: domain exactly |
| Cover every source |
example.com and help.example.com are separate sources and both need registering. Unregistered sources bounce |
Apple also sets limits on the number of sources: up to 32 for individual accounts and up to 100 for organisations.
The marketing subdomain trap
Many teams send campaigns from a subdomain such as news.example.com through an email service provider that uses its own domain in the envelope sender. Apple's documentation says that in this case you must sign messages with DKIM, and the DKIM signature has to match the registered From: domain. SPF alone will not satisfy the relay.
Check this if you have recently changed provider, added a new sending subdomain or started sending transactional and marketing mail from different systems.
Why this problem hides in your reports
A missed registration does not trigger an obvious warning in a campaign report. It appears as bounces on one slice of addresses, and that slice is easy to misread.
- It inflates bounce rate. Relay failures look like any other hard bounce. See email bounce rate for how to read it.
- It can suppress real subscribers. If your email platform automatically suppresses addresses after a hard bounce, people who opted in quietly drop off the list.
- It skews comparisons. Removing those addresses changes your denominator, so before-and-after results need care. Use delivered emails, not sent emails, as the base. How to calculate email click-through rate explains why.
Apple says it periodically notifies the account holder and team admins when it detects emails that could not be delivered through the relay. Make sure those notifications reach someone who reads them.
A worked example (illustrative numbers)
Suppose a list has 40,000 subscribers and 1,200 use relay addresses, which is 3%. If none of those 1,200 can receive your mail because the sending subdomain is unregistered, you lose 3% of your audience without any visible change in your results. If your newsletter generates 0.8 clicks per 100 delivered emails, the impact on total clicks is small in percentage terms. The real cost is that the affected subscribers are people who signed in through your account system, who are often more engaged than a pop-up sign-up. These figures are an example to show the arithmetic, not a benchmark.
A 20-minute audit
- Count relay addresses. Search your list for
@privaterelay.appleid.com and @private.icloud.com. A count of zero means no one has used the hide option, or your forms do not offer it.
- List every sending source. Include marketing, transactional, support and any separate system that emails your subscribers.
- Check registration. In your Apple developer account, open the Sign in with Apple for Email Communication settings. Each source should be registered and show as passing the SPF check.
- Check authentication. Confirm your email platform signs with DKIM on your own domain, and that the DKIM domain matches the From: domain exactly.
- Review suppressions. Find relay addresses suppressed after bounces. Ask your platform whether they can be reinstated once the setup is fixed, and only email people who still want your messages.
- Monitor afterwards. Track bounce rate for relay addresses separately across your next few sends.
What not to do
- Do not remove relay addresses as "fake". They are real people exercising a privacy choice.
- Do not judge them by open rate. Opens are unreliable on Apple devices because of Mail Privacy Protection. Use clicks and conversions. Apple MPP and open rates covers why.
- Do not send from an unregistered subdomain "just once". It will bounce and tells Apple nothing useful about your reputation.
Why this matters beyond one feature
Privacy features are part of deliverability. They are another place where clean authentication decides whether a subscriber hears from you. The discipline that satisfies the Gmail and Yahoo bulk sender requirements also keeps you in good standing with Apple's relay.
To see whether list changes affect results, compare your last campaigns in a free campaign report and use the click-through rate calculator to measure clicks against delivered emails.
Key takeaways
- Hide My Email addresses are real subscribers who forward to a private inbox.
- Apple's relay forwards only authenticated mail from registered sources, and unregistered sources bounce.
- Register every domain and subdomain you send from, and sign with DKIM if your provider uses its own envelope domain.
- Measure these subscribers by clicks and conversions, not opens.
Sources
Related articles
