A random from-domain will not reach a hidden Apple address

Answer A random from-domain will not reach a Hide My Email address. Apple's private relay documentation says those addresses end in private.icloud.com, privaterelay.appleid.com, or icloud.com, and that you must register the outbound domain and authenticate it with SPF before the relay will forward. The relay delivers to a verified Apple Account. It does not deliver a stranger's unregistered domain.

The note that started this: Communicating using the private email relay service, Apple Developer Documentation.

Monday's note was about which suffixes exist. Today's note is about the permission to send to them. A solo ad seller can have a perfect attitude about not purging Apple users and still fail to reach them, because the domain on the From line was never registered with the relay. The opt-in is necessary. The registration is the other necessary thing, and it is the sender's job.

The page is Apple's developer documentation for communicating using the private email relay service. This desk will not pretend the page was published today. Documentation moves. The rule to verify on a live account is the rule the page states when you read it: register outbound domains, authenticate them with SPF, and expect the addresses to sit on those three hosts. The relay then routes to the verified Apple Account the person actually reads. When they reply, the reply comes back through the relay, not from a bare mailbox you can harvest. That is the product. Privacy in both directions. A from-domain that is not on the registered list never enters the product.

Which domains can a private relay address use?

Apple's documentation says private relay addresses end in private.icloud.com, privaterelay.appleid.com, or icloud.com. To send to them, the outbound domain has to be registered and authenticated with SPF.

Three endings, one gate. The gate is the domain you send from, not the domain they hide behind. SPF is the authentication they name. A seller who waves DKIM and has never registered the From domain for the relay has done a different homework assignment. Both can matter. This page is about the registration. Ask to see it. A screenshot of a DNS record is not the same as Apple accepting the domain for relay. The acceptance lives in the Apple account that owns the sending identity.

Ordinary iCloud addresses and Hide My Email addresses share icloud.com, which is why Monday's note refused a bot rule. The relay documentation is why you still cannot treat every icloud.com address as reachable from a cold domain. Some will be ordinary mailboxes that follow ordinary inbox rules. Some will be relay addresses that drop your unregistered from-domain on the floor. The seller who does not know which is which should not be promising you a delivery rate on the Apple slice.

• The from-domain is one the sender registered for the relay.
• SPF is in place on that domain, as Apple asks.
• All three address endings are accepted, not just the oldest one.
• An unregistered domain is described as a miss, not as a mystery bounce.

Where does a reply to one of those addresses go?

The relay routes the message to a verified Apple Account address. Replies come back through the relay. You do not receive the person's underlying mailbox, and they do not receive mail from a from-domain you never registered.

This kills a bad habit. You cannot collect relay replies and reverse them into a raw address to mail from a different system. The reply path is part of the hide. A buyer who wants the leads should expect relay-shaped addresses and should be ready to register their own domain if they will mail those people again. A buyer who wants a naked gmail.com out of an Apple signup wants something the relay is built to refuse.

If you sell the send, register the domain you actually put in the From line. A last-minute from-name swap onto a domain Apple has never seen will silently miss the private-relay slice. Those misses will not look like complaints. They will look like a smaller Apple open rate, and someone will blame the copy.

What does that mean for a solo ad?

A seller sending from a fresh or unregistered domain will not reach Hide My Email subscribers even when those people opted in. Ask whether the from-domain is registered for the relay before you pay for a file that includes those addresses.

Ask it next to the other from-domain questions. Who signs. What p= says. Whether Yahoo complaints have a home. The relay registration is one more line. It is a yes or a no.

Solo ads for affiliate marketing that include Apple's private addresses need a from-domain the relay already knows. Safe solo ads sellers can answer the registration question without turning it into a new upsell. If the answer is no, pay for a different domain or accept that those subscribers will not see the offer.