By William Weiner July 1, 2026
Apple announced this month that all new Hide My Email addresses will move from @icloud.com to @private.icloud.com. Your existing addresses keep working. But every new alias you create from this summer forward carries a domain name that tells any email filter on the planet exactly what it is: a privacy relay. Any site, bank, or mail system that wants to block anonymous signups can now do it with a single rule.
What made Hide My Email work – and what just broke
The reason Hide My Email was effective is the reason Apple is now walking it back. When your alias lived at @icloud.com, it was indistinguishable from any ordinary Apple user’s email. A website could not tell whether you were hiding or not. That ambiguity was the whole point.
@private.icloud.com removes the ambiguity entirely. The domain name announces the intent. Email validation services, corporate mail gateways, and signup-blocking scripts will add it to their filters – some already have. Apple gave developers advance notice to update their allowlists, which means the industry is already treating it as a known relay class.
If you use Hide My Email to sign up for services, the feature just got meaningfully weaker for any new addresses going forward.
The problem that predates Apple’s change
Here is the part that does not get said often enough: your email address was already at risk long before you handed it to a website.
Think about everyone who has your real address in their contacts. Your dentist. Your kids’ teacher. The neighbor who coordinates the block association. The PTA list admin who cc’d the whole school in a reply-all. Every one of those people has your address sitting in their phone’s contacts app, their Gmail, their work Outlook account.
When any of those accounts gets breached – and breaches happen constantly, across every platform, at every scale – your address goes with it. Not to a data broker in six months. Right now, to whoever ran the attack.
This is what privacy people call the blast radius problem. Your real email address is already distributed across dozens of systems you do not control, held by people you trust but whose security you cannot guarantee. A relay service that protects you from websites does nothing about this. The address you gave your dentist three years ago is still sitting there.
What a real alias does differently
An EMail Parrot alias looks like any other email address. It does not live on a domain named @private.anything. It is not on any relay blocklist. When you give it to a new contact – a vendor, a service, a neighbor you just met – they get an address that works like any other.
The difference is what happens when their account gets breached. The attacker gets your alias. Not your real inbox. You can revoke that alias and create a new one. Your actual address was never in their contacts to begin with.
Every message that comes in through the alias gets rebuilt from scratch before delivery. Tracking pixels, embedded address leaks, reply-to traps – stripped before anything reaches you. This is not forwarding. The original message never touches your inbox.
It scales to the groups you are already in
Most people are members of at least one group email list – a family thread, a school parent group, a neighborhood association, a club. These lists are where the blast radius problem gets worse. A list that cc’s 30 people exposes 30 real addresses in a single send. One compromised member account means the whole group’s contact information is accessible to an attacker.
With EMail Parrot, members of a group only ever see the group address. Not each other’s real inboxes. When someone leaves the group or a member’s account is compromised, the exposure stops at the list. The real addresses behind it are never in the picture.
The window while it still matters
Apple’s old @icloud.com aliases – the ones already created – will keep working for now. But the feature is degraded going forward, and the broader issue of contacts-list exposure has no fix inside the Apple ecosystem.
EMail Parrot is free to start. Your first list, your first aliases, no credit card. If you have been relying on Hide My Email and wondering what comes next, or if you have never had a relay layer between your real inbox and the world, this is a reasonable time to try one that does not announce itself.
Questions about migrating? Email us at info@emparrot.com.