Verifying iCloud Mail addresses

• A nonexistent local part returns 550 5.1.1 with a User unknown style message. Apple is comparatively direct about this.
• Apple applies connection limits, though less aggressively than Microsoft, and a sensible probe rate gets consistent answers.
• Hide My Email aliases on the privaterelay.appleid.com domain are real, routable addresses that forward to the user's actual mailbox and can be disabled in two taps.
• An alias that has been switched off returns a rejection, so the verdict is correct at the moment we check it and may not be correct next week.

• Apple Mail Privacy Protection preloads images for most Apple Mail users, so open rates from this audience are close to meaningless.
• Because opens are unreliable here, judge engagement on clicks and replies or you will keep a dead segment alive for months.
• A high share of relay addresses usually means your signup flow offers Sign in with Apple. That is fine, but plan for faster decay.

Say your list has anna.lee@mac.com from a 2006 purchase, anna.lee@me.com from a 2010 newsletter signup, and anna.lee@icloud.com from last year. Those three rows are very likely one mailbox. Apple gave people who held a mac.com address matching me.com and icloud.com addresses, and people who joined in the me.com years got an icloud.com twin. All three verify as valid, and you pay to mail the same person three times.

You can't run that logic in reverse. Accounts created after 2012 only have the icloud.com form, so you can't invent a me.com version of a newer address and expect it to work. Match on the local part across the three domains, flag the matches as probable duplicates, and let a human or an engagement record decide which row to keep. Verification can't make this call for you, since each of the three addresses exists and answers on its own.

Most guides tell you to watch for privaterelay.appleid.com. That domain covers Sign in with Apple and nothing else. iCloud+ subscribers have a second way to use Hide My Email, which creates random addresses directly on icloud.com, usually a couple of unrelated words and some digits. Nothing in the domain gives them away, and they answer a probe just like a personal mailbox until the owner deactivates one.

You can't detect these with certainty, and we don't pretend to. What you can do is notice the pattern in a signup cohort. A run of word-pair local parts on icloud.com from one campaign suggests privacy-minded signups, and each of those addresses can be switched off without touching the real mailbox. iCloud+ also hosts custom domains, so a family or small-business domain whose MX is mx01.mail.icloud.com is Apple mail under another name.