Using Apple's Private Email Relay with Postmark

For an App Developer to use Sign in with Apple with Postmark, there are additional configuration steps necessary. This is because Sign in with Apple allows users to create anonymous email addresses, and Apple has additional requirements to prevent spam.

The steps within Postmark are:

1. Configure DKIM. Apple’s Email Relay requires the email to be sent with DKIM signed by the sending domain.

1. Configure a Custom Return-Path. This feature also requires the MAIL FROM (Return-Path) to match the sending domain.

1. Add an SPF Record for Postmark. Generally, Postmark does not require setting up an SPF record, though for Apple’s Private Email Relay to work, an SPF record is required. Postmark’s SPF record to add is:

   v=spf1 include:spf.mtasv.net ~all

IMPORTANT! The above steps are specific to Postmark. For further detail and a list of steps specific to Apple Private Relay itself (like registering a domain), please see their app capabilities documentation and their Sign in with Apple Documentation.

Required Configuration Steps in Apple Developer

Authentication on the email side is only half of the puzzle. Apple will actively block traffic if the sending origins are not explicitly allowlisted within your developer portal.

• Register Your Sending Domains and Addresses: You must explicitly register your verified Postmark sending domains and the specific outbound email addresses (such as notifications@yourdomain.com) inside your Apple Developer account under the Sign in with Apple email relay settings.

Troubleshooting Failed Deliveries

If you attempt to send an email before completing the registration steps inside your Apple Developer account, the messages will fail to deliver.

Apple’s postmaster will bounce these emails with the following specific error status:

5.1.1 (bad destination mailbox address)

This specific bounce status can be misleading, as it frequently implies the recipient's anonymous email address does not exist. If you encounter a wave of 5.1.1 bounces specifically from Apple relay addresses, double-check that your outbound email address is accurately registered in your Apple Developer console.