iCloud+ Hide My Email addresses will remain on icloud.com

Original Article ↗ Hacker News Discussion ↗

Apple has reversed plans to move its iCloud+ “Hide My Email” aliases off the main @icloud.com domain, keeping them indistinguishable from regular iCloud addresses. Commenters argue this is crucial for privacy because a separate relay domain would make it trivial for sites to block or penalize masked emails, while also touching on related issues like email reputation, spam filtering, and Apple’s broader posture on privacy and platform control.

Overall reaction

  • Many are relieved Apple reversed course and kept Hide My Email on @icloud.com.
  • Change is seen as Apple listening to community feedback, though some view it as evidence of weakened internal decision-making.

Why keeping @icloud.com matters

  • Core benefit: Hide My Email aliases are indistinguishable from normal iCloud addresses, making them hard to filter or block.
  • Using a special domain like private.icloud.com would make it trivial for sites and anti-abuse systems to reject or treat them differently, undermining the feature.
  • Several people say this “shared domain with normal users” approach is the only robust way for private relays to survive; Fastmail is cited as a similar model.

Sign in with Apple vs Hide My Email

  • Thread repeatedly clarifies:
    • “Sign in with Apple” addresses are moving from privaterelay.appleid.com to private.icloud.com.
    • iCloud+ “Hide My Email” aliases stay on @icloud.com.
  • Confusion stems from Apple using “hide my email” terminology in both contexts.

Infrastructure, bugs, and privacy leaks

  • Some argue the original plan for a separate domain was to fix internal bugs where relayed addresses could leak the real email (e.g., in bounce messages or APIs resolving aliases).
  • Others counter that a domain change alone doesn’t solve such leaks; correctness in handling aliases is the real issue.
  • Overall, details of the underlying bug are considered unclear.

Email reputation, bounces, and blocking

  • Concern that deactivated aliases create bounces, which can hurt sender reputation via email service providers.
  • Debate over whether Apple should bounce vs silently discard; some want bounces to penalize spammers, others think bounces are pointless noise.
  • Some report Gmail aggressively classifying iCloud emails as spam; others rely on filters or accept this as Gmail’s issue.

Lock‑in, domains, and alternatives

  • Critique: using @icloud.com and not supporting user-owned domains for Hide My Email creates platform lock‑in; switching away later means updating many accounts.
  • Counterpoint: this is similar for any major provider; most users don’t use custom domains anyway.
  • Several compare to Fastmail, SimpleLogin, Proton, Firefox Relay, Migadu, etc., noting that alias domains are often blocked while big-consumer domains (iCloud, Gmail) are not.

Apple’s privacy stance and ecosystem leverage

  • Some praise Apple as the only “big tech” player heavily investing in privacy (Hide My Email, Private Relay, Private Cloud Compute).
  • Others see privacy as a luxury branding strategy rather than ethics, and note limits (e.g., app store control, browser engine restrictions, earlier on-device photo scanning proposal).
  • Multiple comments note Apple’s market share lets them force acceptance of privacy features: blocking iCloud domains or Private Relay would mean losing too many users.