What email masks hide and what they still reveal

A random address forwards to a real inbox

Apple's iOS 26 guide describes Hide My Email in iCloud+ as unique, random addresses that forward to a personal email account. This avoids supplying that personal address in the supported signup or email flow. The selected address still serves as a contact route that a website can associate with its account. Apple iPhone User Guide: iOS 26 random forwarding addresses

Sign in with Apple uses a particular relay route

Apple says Hide My Email addresses created through Sign in with Apple use the privaterelay.appleid.com domain. Only the app or website's designated sending addresses can forward through that route to the verified Apple Account email. This is a specific service relationship, not a new general-purpose inbox for all senders. Apple: Sign in with Apple relay addresses and approved senders

The relay provider still has a role

Mozilla's privacy notice says Relay processes messages to forward them and keeps the association between primary and masked addresses. It also describes stored mask labels and sites where masks are created or used, plus technical and IP information. A mask should not be interpreted as anonymity from the relay provider. Mozilla: Relay processing, account mapping and usage information

Dots in personal Gmail addresses are not a random mask

Google says dotted versions of a personal Gmail address are the same address and reach one inbox. Adding periods therefore does not create a separately hidden contact identity. Google explicitly distinguishes work, school and other organization domains, where dots can change the address. Google: dotted personal Gmail addresses share one identity

Apple deactivation and deletion have different consequences

Apple's iCloud guide says deactivated Hide My Email addresses can be reactivated, and mail to them is returned to the sender while inactive. Permanently deleting an inactive address cannot be undone and affects all devices set up for that feature. Apple: reversible deactivation versus permanent address deletion

A blocked Relay mask differs from a deleted one

Mozilla documents temporarily blocking forwarding to a Relay mask and allowing it again later. Marking a forwarded message as spam can also automatically disable that mask's forwarding. A change in delivery is therefore not necessarily proof that the website stopped sending messages. Mozilla: temporary forwarding blocks and spam effects

Mozilla says a deleted mask cannot be recovered. If a mask is used to sign in to a website, it advises updating that site's login address before deleting the mask. Removing delivery without checking account access can create a recovery problem. Mozilla: permanent mask deletion and login consequences

Delivery requirements can limit where a mask fits

Mozilla's creation guide recommends masks for less critical signups and cautions against them where identity verification, important messages or attachments are required. The guide gives examples including healthcare, banking and travel documents. Those are provider-documented delivery cautions, not a guarantee that every mask works with every service. Mozilla: email mask creation and critical-message limits