Domain Transition for Sign in with Apple

Date: August 24, 2026

Apple has announced a shift in how email addresses are generated for the Sign in with Apple feature. Starting later this year, the system will transition to a new domain for issuing these unique identifiers.

🌐 Domain Migration Overview

Previously, new addresses were created using the privaterelay.appleid.com domain. Moving forward, these will be issued via private.icloud.com.

"After further consideration and reviewing community feedback, iCloud+ Hide My Email addresses will remain on icloud.com."

iCloud+ Hide My Email addresses were considered for migration $\rightarrow$ They will stay on icloud.com.

🛠️ Technical Implementation

For developers, the primary goal is to ensure that the transition is seamless for the end-user. Existing addresses on the legacy domain will continue to function and forward mail without any disruption.

Email Relay Logic

The following diagram illustrates the flow of the Private Email Relay Service:

Developer Requirements

To maintain service continuity, developers must update their backend logic. The acceptance criteria for email validation can be expressed as:

$\text{Accepted Domains} = \{ \text{privaterelay.appleid.com} \} \cup \{ \text{private.icloud.com} \}$

Required Actions:

• Update account database schemas.
• Modify email validation regex/logic.
• Expand domain allowlists.

Example of a conceptual validation check in javascript:

const allowedDomains = ['privaterelay.appleid.com', 'private.icloud.com'];
const userEmail = "unique_id@private.icloud.com";

if (allowedDomains.some(domain => userEmail.endsWith(domain))) {
    console.log("Email domain is valid.");
}

For more detailed documentation, please refer to the guides on Sign in with Apple and Communicating using the Private Email Relay Service.