# Emails to privaterelay.appleid.com: why they bounce and how to fix it

> Emails to a privaterelay.appleid.com email address bounce until you register your sending and MAIL FROM domains with Apple. Steps, SPF and DKIM rules.

Canonical: https://www.cresca.xyz/docs/knowledge-base/apple-private-relay
Last updated: 2026-11-13

A privaterelay.appleid.com email address only accepts mail from senders you have registered with Apple. This guide explains why these emails bounce and the steps that fix it.

## What is a privaterelay.appleid.com email address?

When someone signs in to your app with Sign in with Apple and chooses to hide their email, Apple gives your app a random address such as `dpdcnf87nu@privaterelay.appleid.com` instead of their real one. Apple's private email relay service forwards mail sent to that address to the person's real inbox.

Each address is unique to one user and one developer account, and it works like any other recipient address: you store it, and you send password resets, receipts and other email to it.

## Why emails to privaterelay.appleid.com bounce

The relay only accepts email from sources that the app's developer has registered with Apple. Email from any other domain or address is rejected and comes back as a bounce. This is the cause in almost every case: the app works, sign-in works, and every email to a relay address bounces because the sending domain was never registered.

The usual triggers are:

- You never registered an email source in your Apple Developer account.
- You registered `acme.com` but send from a subdomain such as `mail.acme.com`. Apple treats a subdomain as a separate source.
- You changed email provider, so the Return-Path (MAIL FROM) domain of your email changed and the new one is not registered.
- SPF fails for the registered domain, or the email is not signed with DKIM.

## How to fix privaterelay.appleid.com email bounces

1. Sign in to your Apple Developer account and open **Certificates, Identifiers & Profiles**.
2. Choose **Services** in the sidebar, then **Configure** under Sign in with Apple for Email Communication.
3. In **Email Sources**, press the add button and enter every domain and subdomain you send from, separated by commas. You can also register single email addresses if you do not own the domain.
4. Register the domain in your **From** address and the domain in your **Return-Path** (also called MAIL FROM or the bounce address). Apple checks SPF against the Return-Path domain, and it must match a registered domain exactly.
5. Save, then send a test email to a relay address.

| Apple Developer membership | Email sources you can register |
| --- | --- |
| Individual | Up to 32 |
| Organization | Up to 100 |

These steps and limits are from Apple's developer help page for the private email relay service, checked on November 13, 2026.

## SPF and DKIM rules for the relay

- Every registered domain needs an SPF record.
- Each email must pass SPF or DKIM. Apple recommends both, and so do we: forwarding can break SPF, and DKIM survives it.
- For SPF, the Return-Path domain must be a registered domain and must pass SPF for the server that sent the email.
- For DKIM, the signing domain (the `d=` value) must match the domain in your From address exactly, and the From header must be part of the signature.

## Sending to Apple private relay addresses with Cresca

Cresca signs your email with DKIM for your verified domain and uses a custom MAIL FROM subdomain on that same domain, so both checks can pass. You need to register two entries with Apple:

- The domain of your sender address, for example `acme.com` or `mail.acme.com`.
- The MAIL FROM subdomain that Cresca shows next to your DNS records in [Sending Domains](https://app.cresca.xyz/sending-domains).

Both must be verified in Cresca first. See the [quickstart](https://www.cresca.xyz/docs/quickstart) for how to verify a domain.

A bounce from the relay counts as a bounce. If relay addresses bounced before you registered your domains, check whether they were added to your [suppression list](https://www.cresca.xyz/docs/suppression), because suppressed addresses are not sent to again.

## How to check that it works

1. Sign in to your own app with Sign in with Apple and choose to hide your email, so that you have a relay address to test with.
2. Send an email to that address from the same sender your app uses.
3. Confirm that it reaches your real inbox, and check its status in Cresca. The [email lifecycle](https://www.cresca.xyz/docs/email-lifecycle) shows `delivered` or `bounced`.

Apple can also email your developer account when the relay could not deliver your mail. The setting is on the same Configure screen.

## Other reasons a relay address stops working

A user can turn off forwarding for your app in their Apple Account settings, or stop using Sign in with Apple with your app. Email to that relay address then no longer reaches them, and registering more domains will not change it. Offer a way to add a contact email inside your app for users who want one.

[Previous Add contacts](https://www.cresca.xyz/docs/api-reference/add-contacts)

Last updated November 13, 2026. Questions? [lalit@cresca.xyz](mailto:lalit@cresca.xyz)