How to Configure Custom Email Domains and Hide My Email in iCloud+

Modern personal and freelance digital communications increasingly require professional custom domain branding alongside robust privacy safeguards against spam harvesting and data broker profiling. Traditionally, operating a personalized email domain (e.g., [email protected]) required purchasing enterprise email hosting plans from Google Workspace or Microsoft 365, while protecting one’s personal inbox required third-party email forwarding relays.

With iCloud+, Apple integrated both capabilities directly into its standard consumer cloud subscription tiers. Subscribers can connect up to five personalized custom email domains to their personal Apple ID or Family Sharing group, complete with MX, TXT (SPF), and CNAME (DKIM) authentication records. Simultaneously, iCloud+ provides Hide My Email—a dynamic alias generation engine that provisions disposable, unique forwarding addresses on the fly for newsletters, e-commerce checkouts, and web app registrations. This technical guide outlines domain DNS verification requirements, Family Sharing routing, and Hide My Email alias management across iOS, macOS, and the web.

Feature Matrix: Custom Email Domain vs. Hide My Email

Understanding how the two iCloud+ messaging architectures function clarifies their respective roles in your communication strategy:

Feature	Primary Purpose	DNS & Identity Configuration
Custom Email Domain	Sends and receives emails using your own vanity domain name (e.g., [email protected]).	Requires configuring public DNS records (MX, SPF, DKIM) at your domain registrar.
Hide My Email	Creates randomized @icloud.com aliases that forward silently to your primary inbox.	Managed entirely within Apple’s secure relay network; zero DNS configuration required.

Step 1: Adding a Custom Email Domain to iCloud+

You can initiate custom domain onboarding from any Mac running macOS Monterey or later, an iPhone running iOS 15 or later, or via icloud.com:

1. Sign in to iCloud.com with your Apple ID and open Account Settings.
2. Scroll to the Custom Email Domain section and click Manage.
3. Choose who will use the domain:
   • Only You: Restricts address creation to your personal Apple ID.
   • You and Your Family: Authorizes up to five members in your iCloud Family Sharing group to create personalized addresses under the domain.
4. Enter your registered domain name (e.g., example.com) and click Continue.
5. Enter any existing email addresses you currently use on this domain so Apple can verify routing, or proceed to create new addresses.

Step 2: Configuring DNS Records at Your Domain Registrar

To authorize Apple’s mail servers to receive and dispatch signed emails on behalf of your domain, you must input the following DNS records into your registrar’s DNS management console (e.g., Cloudflare, Namecheap, GoDaddy):

Record Type	Host / Name	Points to / Value	Priority / TTL
MX	@	mx01.mail.icloud.com.	Priority: 10
MX	@	mx02.mail.icloud.com.	Priority: 10
TXT (SPF)	@	v=spf1 include:icloud.com ~all	Auto / 3600
CNAME (DKIM)	sig1._domainkey	sig1.dkim.example.com.at.icloudmailadmin.com.	Auto / 3600
TXT (Verify)	@	apple-domain-verification=UniqueAppleTokenString	Auto / 3600

Note: If your registrar supports automated Connect integrations (such as Cloudflare), iCloud provides a one-click automated authorization button that configures these records via API.

Step 3: Verifying Domain and Assigning Email Addresses

1. Once DNS records are saved, return to the iCloud setup screen and click Verify DNS records.
2. When DNS propagation completes (typically between 5 minutes and 2 hours), Apple displays a green confirmation badge: “Domain is ready to use”.
3. Click Add an email address. Enter your desired mailbox handle (e.g., [email protected]).
4. Open the native Mail app on your iPhone, iPad, or Mac. In account settings, your new custom domain address automatically appears in the From address selector dropdown.
5. Catch-All Email: You can toggle on Allow All Incoming Messages (Catch-All) within the domain settings to receive messages sent to unregistered addresses (e.g., [email protected] or [email protected]).

Step 4: Using Hide My Email for Privacy and Alias Generation

While custom domains establish brand identity, Hide My Email shields your real address from untrusted third parties:

Generating an On-Demand Alias in Safari

1. When registering on a website or newsletter form in Safari, click the email address field.
2. Safari displays a QuickType suggestion titled Hide My Email.
3. Click the option. iCloud generates a unique, randomized @icloud.com alias (e.g., [email protected]).
4. The alias forwards all incoming mail directly to your primary Apple ID mailbox while keeping your real address completely hidden from the merchant.

Creating Custom Manual Aliases in Settings

1. On macOS, open System Settings > tap your Apple ID profile > iCloud > Hide My Email (or on iOS: Settings > Apple ID > iCloud > Hide My Email).
2. Tap + Create New Address.
3. Label the address with the name of the service (e.g., Fitness Tracker App) and add descriptive notes.
4. Whenever you reply to an email sent to this alias, Apple’s private relay proxy rewrites your outbound email headers so your response originates from the alias rather than your personal address.
5. If a service begins spamming you, locate the alias in Settings and toggle Forward To to Off or tap Deactivate email address to terminate the forwarding pipe instantly.

Security and Operational Guidelines

• DMARC Configuration: For maximum email deliverability to Gmail and Yahoo recipients, add a DMARC policy TXT record at your registrar:

  v=DMARC1; p=quarantine; pct=100; rua=mailto:[email protected]

• Exporting Data Before Downgrade: If you cancel your iCloud+ subscription, custom email domain routing suspends immediately. Re-point your MX records before downgrading to avoid bounced emails.