Skip to main content
If your app offers Sign in with Apple, some of your subscribers have an address like a1b2c3d4e5@privaterelay.appleid.com or a1b2c3d4e5@private.icloud.com. Legacy relay addresses can also use @icloud.com. These are real, working mailboxes that forward to the person’s actual inbox - but Apple only forwards mail from senders you have registered. Until you register, Apple rejects every message with:
This looks like an invalid address, but it is not. The mailbox is fine. Your sending domain simply is not on Apple’s allowlist yet.
Do not delete these subscribers. Once you complete the setup below, the same addresses start delivering. Sequenzy keeps them as temporary bounces specifically so they survive until you do.

​
Register your domains with Apple

Apple validates SPF against the envelope sender - the Return-Path domain - not the From address your recipients see. Those are different domains in Sequenzy, and registering only the visible one is the most common reason mail keeps bouncing after you believe the setup is done. Register every source shown in Sequenzy.
  1. In Sequenzy, go to Settings → Sending domains and open your domain.
  2. Find the Apple Private Relay section. It appears once your audience contains at least one relay address, and lists the exact domains to register, including your Return-Path domain (something like send.mail.yourdomain.com).
  3. Sign in to your Apple Developer account and go to Certificates, Identifiers & Profiles → Sign in with Apple for Email Communication.
  4. Under Email Sources, add every domain from step 2.
  5. Click (Re)Verify SPF on each one. Apple requires the domain to publish a valid SPF record - if your Sequenzy domain is already verified, it does.
Delivery starts on your next send. Apple’s documented limits are up to 32 email sources for an individual developer and up to 100 for an organization.

​
How Sequenzy handles the bounces

An Apple relay rejection for an unregistered sender is recorded as a temporary bounce, labelled “Apple Private Relay - sending domain not registered with Apple”. Unlike a normal bounce, it:
  • never adds the address to the global suppression list
  • never marks the subscriber as bounced
  • never counts toward your account or campaign bounce thresholds
A relay address that the recipient actually deleted (Apple returns 550 5.1.1 user unknown for those) is still treated as a permanent bounce and suppressed normally.

​
Finding your relay subscribers

To see how many you have, create a segment with an OR filter for Email · contains · privaterelay.appleid.com, Email · contains · private.icloud.com, or Email · contains · icloud.com. The last match also includes ordinary iCloud mailboxes, so use it only when that broader audience is acceptable. If your app does not use Sign in with Apple, or you do not have an Apple Developer account, you can exclude that segment from your campaigns. Prefer that over deleting the subscribers - you keep the contacts if you register later.

​
Via the API

GET /v1/websites/{domain} returns the values to register: