Apple drops planned Hide My Email domain change after community feedback

Apple has reversed a planned change to its Hide My Email service, keeping new email aliases on the existing iCloud.com domain.

The decision means users of the privacy feature will not face a change that could have made aliases easier for websites and services to identify and block.

Apple said it reconsidered the plan after reviewing community feedback. The reversal comes after a difficult period for Hide My Email, including a separate security flaw that exposed users to the risk of their real email addresses being revealed.

How Hide My Email protects your address

Hide My Email is available to users with an iCloud+ subscription and lets them create random email aliases that forward messages to their actual inboxes.

Instead of giving a company a personal email address when creating an account, users can provide a unique iCloud alias. Messages sent to that address still arrive in the user’s regular inbox, while the underlying email address remains hidden.

The aliases can also be deactivated if they become compromised or start generating unwanted messages. That gives users a way to cut off an address without having to replace their primary email account.

Apple had planned to change the alias domain

Apple announced in June that it planned to move newly generated Hide My Email aliases from iCloud.com to private.icloud.com.

The company planned to unify the domains used by Hide My Email and Sign in with Apple under the shared private.icloud.com domain. Existing Hide My Email addresses on iCloud.com would have continued working without interruption.

The proposal raised concerns because Hide My Email currently shares the iCloud.com domain with ordinary iCloud email accounts. Blocking that entire domain could also affect regular iCloud users.

A dedicated private.icloud.com domain would have made Hide My Email aliases easier for websites and automated systems to identify separately. That could have allowed services to block newly generated aliases without also blocking ordinary iCloud email addresses.

Apple has now reversed the plan

Apple has confirmed that Hide My Email will remain on the iCloud.com domain. The company said the decision followed further consideration and a review of community feedback.

That means newly generated aliases will continue to use the existing domain rather than switch to the proposed private.icloud.com format.

Existing aliases were expected to continue working under the original plan, but the bigger concern involved new addresses. If websites began blocking the new domain, Hide My Email’s usefulness for future signups could have been reduced.

By keeping the existing domain, Apple is preserving the system’s current behavior and avoiding that potential compatibility problem.

The decision follows a separate security issue

The domain reversal is not the only recent controversy surrounding Hide My Email. In July 2026, a security flaw became public that could reveal the real email address behind a Hide My Email alias.

Security researcher Tyler Murphy first reported the vulnerability to Apple in June 2025, and 404 Media independently verified that it remained exploitable when the issue became public on July 1, 2026.

Apple later said it deployed a patch on July 3 that fully resolved the vulnerability, and 404 Media subsequently confirmed that the original flaw was no longer exploitable. However, AppleInsider reported that it was able to reproduce the behavior on July 17, after Apple’s stated patch date.

The vulnerability was particularly significant because Hide My Email is specifically designed to prevent users from having to disclose their real email addresses.

Why the domain matters for privacy

The usefulness of Hide My Email depends partly on aliases behaving like ordinary email addresses. A website that cannot distinguish an alias from a normal iCloud address is more likely to accept it during registration.

That allows users to maintain the privacy benefit without losing access to services that require an email address. A dedicated private.icloud.com domain would have changed that balance. Companies could potentially recognize the address as an alias before allowing an account to be created.

That would not necessarily have affected every website, but widespread blocking could have made the service less practical.

Apple’s decision to keep the iCloud.com domain, therefore, preserves an important part of how the feature currently works.

Alternatives are available for users seeking more aliases

Users who prefer not to rely on Apple’s service have other email alias options. Proton offers hide-my-email aliases, with up to 10 aliases on Proton Free and unlimited aliases on higher-tier plans.

DuckDuckGo also provides an email protection service that creates aliases using the duck.com domain. Mozilla offers Firefox Relay, which provides email aliases and also supports phone number protection.

These services offer similar approaches, allowing users to provide alternate contact details instead of exposing their primary email address.

Apple keeps Hide My Email on its current path

For now, Apple’s reversal means Hide My Email will continue using the iCloud.com domain for new aliases. That removes a planned change that could have made the addresses easier for companies and automated systems to identify.

The decision also comes after Apple addressed a security flaw in the service, making the latest update particularly relevant for users who rely on aliases for privacy.

The broader strategy remains straightforward. Apple is keeping the existing domain structure while allowing users to continue creating aliases that forward to their real inboxes. For people who regularly avoid sharing their primary email address, the service should continue to work much as it has before.

TL;DR

• Apple has canceled plans to move new Hide My Email aliases to the private.icloud.com domain.
• New Hide My Email aliases will remain on the iCloud.com domain.
• Apple said it reversed the planned change after further consideration and a review of community feedback.
• The proposed domain could have made it easier for websites to identify and potentially block aliases.
• Hide My Email allows iCloud+ users to create aliases that forward messages to their real email addresses.
• Apple also recently fixed a security flaw that could have exposed users’ real email addresses.
• Proton, DuckDuckGo, and Mozilla Firefox Relay offer alternative email alias services.

Don’t forget to follow us for more exclusive content.

If you liked this, you might also like:

• Why Meta’s federal case matters far beyond Facebook and Instagram
• Jonathan Haidt says the Meta lawsuit could force social media giants to fix their platforms
• Bernie Sanders cites a poll showing strong public opposition to new data centers near homes

This article was made with AI assistance and human editing.