iCloud+ Custom Email Domain: Setup, DNS, and Catch-All

iCloud+ Custom Email Domain lets you send and receive iCloud Mail at addresses on a domain you own, such as you@example.com. You add the domain at iCloud.com or in Settings on iPhone, add iCloud’s MX, SPF, DKIM, and verification records to its DNS, and create up to three addresses per person on each of up to five domains. To also receive mail at addresses nobody has created, the domain owner turns on Allow All Incoming Messages, iCloud’s catch-all.

Menu paths below come from Apple’s guides for iOS 27 and macOS 27 Golden Gate, checked on September 25, 2026. Once catch-all mail arrives, CatchNone can read it on iPhone, iPad, and Mac and badge each message with the address it reached, so a leaked or sold address shows up.

What iCloud+ Custom Email Domain includes and its limits

Custom-domain mail lands in the same inbox as your @icloud.com mail, in Mail on any device signed in to your Apple Account with iCloud Mail on, and at iCloud.com/mail. It counts toward your iCloud storage.

The domain and address limits are from Apple’s Custom Email Domain overview, and the sending limits from iCloud Mail’s limits page. Managed Apple Accounts aren’t supported, and the feature isn’t offered everywhere: Apple’s feature availability page lists the countries and regions. The domain itself is a separate cost, paid to your registrar; what your own domain costs and risks covers the trade-off.

Before you start

• iCloud+, on your own account or shared with you through Family Sharing.
• Two-factor authentication on your Apple Account, and a primary @icloud.com address.
• Access to your domain’s DNS, at your registrar or a DNS host such as Cloudflare.
• A list of addresses you already use on the domain. Apple sends each one a verification email, and setup can’t finish until they’re verified. Add them before you change any records, while they still reach your current mailbox. They count toward each person’s three; any beyond that can receive only through Allow All, in the owner’s inbox, and won’t appear in iCloud’s From menu.

You can’t add an address that is already the email address of another Apple Account. Change that account’s email address first; deleting the account doesn’t free the address (Apple).

Three ways to add a domain

Apple never hosts your DNS. It offers three routes:

1. Buy a domain in iCloud (Buy a Domain on iPhone, “Buy a new domain” on iCloud.com). The purchase goes through Cloudflare’s registrar, the email records are created for you, and you manage the domain and its renewal at Cloudflare. Cloudflare’s notes on iCloud domains say you’re charged in US dollars and Apple Pay can’t be used for automatic renewals. Cloudflare also turns on a landing page for the new domain; turn it off before you add website records. You must be 18 or older.
2. Use a domain you own, with automatic setup. For some registrars, iCloud sends you to sign in there, and the registrar writes the records for you. Apple doesn’t publish which registrars support this.
3. Use a domain you own, with manual records you copy into your DNS host yourself.

Add a domain on iCloud.com

1. Go to icloud.com/icloudplus, sign in, and select Custom Email Domain.
2. Select “Add a domain you own.” If you’ve added a domain before, scroll down to find it.
3. Choose Only You or You and Other People, enter the domain, then select Continue.
4. Type existing addresses under the right person’s name, or select “No email addresses.” Select “Add email address(es),” then verify each one from Apple’s email.
5. Select View, then update the records: sign in to your registrar if iCloud offers it, or add the records from the DNS table below at your DNS host. On Cloudflare, read the Cloudflare notes first.
6. Select “Finish setup,” choose your default address, and optionally import mail from your previous provider.

Apple’s guide to adding a domain you own lists the same steps.

Add a domain on iPhone (iOS 27)

1. Go to Settings → [your name] → iCloud → Mail (under Saved to iCloud), and make sure “Use on this iPhone” is on.
2. Tap Custom Email Domain, then Buy a Domain or Use a Domain You Own, and follow the onscreen steps.

Apple’s iPhone guide has the full steps.

Add a domain on a Mac (macOS 27)

Go to System Settings → [your name] → iCloud → Saved to iCloud → Mail, turn on Sync this Mac, and click Options next to Custom Email Domain. Click Continue to open iCloud.com, where the rest happens.

iCloud custom email domain DNS settings (MX, SPF, DKIM, TXT)

These are the records from Apple’s manual setup page, shown for example.com. TTL is in seconds.

The DKIM value contains your own domain name. Copy it, and the verification record, from the setup screen or the email Apple sends.

Four things to get right:

• Delete your old MX records first. Sending servers pick among all of a domain’s MX records by priority and share mail between equal ones (RFC 5321), so a leftover record from your old host can quietly take some or all of your mail.
• Keep one SPF record. If you already have one, add include:icloud.com before ~all instead of creating a second. Two v=spf1 records make SPF fail outright (RFC 7208). SPF also allows only 10 DNS lookups, and include:icloud.com uses 5 of them (as of September 2026), so merging several senders can go over.
• Match your registrar’s format. If it doesn’t accept @, enter the domain name as the host. Apple suggests keeping the trailing periods and quotes, and removing them only if the record fails.
• Give it time. Apple says verification usually takes a few minutes but can take up to 24 hours, and record changes up to 72 hours.

Check the records yourself

In Terminal on a Mac, run these three lookups. Good output looks like this (the code after apple-domain= is yours):

$ dig example.com mx +short
10 mx01.mail.icloud.com.
10 mx02.mail.icloud.com.
$ dig example.com txt +short
"apple-domain=AbCdEf123456"
"v=spf1 include:icloud.com ~all"
$ dig sig1._domainkey.example.com cname +short
sig1.dkim.example.com.at.icloudmailadmin.com.

The MX lookup should show the two iCloud hosts and nothing else, and the TXT lookup exactly one v=spf1 line. Google’s Admin Toolbox Dig runs the same lookups in a browser.

Using an iCloud custom domain with Cloudflare DNS

Three Cloudflare settings trip people up. Cloudflare’s email troubleshooting page and proxy status page cover them.

• Keep the DKIM CNAME DNS only. MX and TXT records are always DNS only, but a CNAME can be proxied. Cloudflare may warn about, or block, proxying a DKIM record, so leave its proxy status as DNS only.
• Watch CNAME flattening. If flattening applies to all CNAMEs or to this one, sig1._domainkey is flattened to an address record, which can stop mail providers from reading it. Turn flattening off for it.
• Turn off Email Routing in the right order. Its MX, SPF, and DKIM records are locked. Go to Compute → Email Service → Email Routing, select the domain, open Settings, and choose Unlock on each record. Add iCloud’s records, then select Disable Email Routing (Cloudflare’s steps). Disabling removes the records Email Routing added, possibly including an SPF record you merged iCloud into. Afterward, check that no route1.mx.cloudflare.net, route2.mx.cloudflare.net, or route3.mx.cloudflare.net MX records remain, and that exactly one v=spf1 record exists, containing include:icloud.com but not include:_spf.mx.cloudflare.net.

A domain bought through iCloud already sits at Cloudflare with its email records created. If mail doesn’t arrive, Cloudflare suggests checking those records in its dashboard, then contacting Apple Support if they look right. If you’d rather keep Email Routing and read the domain in Gmail, see using Gmail with a custom domain through Cloudflare.

Turn on iCloud catch-all (Allow All Incoming Messages)

Only the domain owner can turn this on. If it fails with “Make sure your domain’s records are correct and try again,” fix the records first.

On iCloud.com

1. Go to icloud.com/icloudplus and select Custom Email Domain.
2. Select your domain and scroll down to “Allow All Incoming Messages: Off.”
3. Select Turn On Allow All, then Turn On to confirm.

On iPhone (iOS 27)

1. Go to Settings → [your name] → iCloud → Mail (under Saved to iCloud).
2. Tap Custom Email Domain, then your domain.
3. Turn on Allow All Incoming Messages.

Apple’s iPhone guide describes the same switch.

On a Mac

The Mac has no switch of its own; System Settings sends you to iCloud.com.

Where catch-all mail goes

According to Apple’s Allow All page:

With Allow All off, mail to addresses that don’t exist is returned to the sender. A catch-all also collects spam sent to guessed names; the trade-offs are in what a catch-all email address is. At other hosts the same switch has other names; see how to set up a catch-all email.

Stop mail to one address

An address that exists only through Allow All was never created, so there’s nothing to delete. To stop one while Allow All stays on:

• Trash it with a rule. Add an iCloud Mail rule: “is addressed to” leaked@example.com → “Move to Trash.” The sender gets no bounce.
• Create it, then delete it. Apple says mail to a deleted address is returned to the sender, even with Allow All on. You need a free slot to create it, and Apple doesn’t present this as a way to block addresses, so send a test afterward.

An address you created can be deleted. To stop them all, turn off Allow All.

Which addresses can you send from?

iCloud’s From menu offers only addresses you’ve created and chosen under Send From. An address that exists only through catch-all isn’t offered, so to reply as shop@example.com, create it first; it uses one of your three slots.

To choose your sending addresses on iCloud.com:

1. Go to icloud.com/mail, select the icon at the top of the Mailboxes list, then choose Settings.
2. Select the email address below Send From, then select every address you want to send from.
3. Choose one in the Default Send Address menu, then select Save.

Apple’s guide to choosing a default address has the same steps.

In other mail apps, use IMAP imap.mail.me.com, port 993, SSL/TLS, with the part of your @icloud.com address before the @ as the username (or the full address, if that fails). For SMTP, use smtp.mail.me.com, port 587, with your full @icloud.com address as the username (Apple’s settings). Both need an app-specific password, covered in iCloud app-specific passwords.

Apple’s record list has no DMARC record. Gmail requires only SPF or DKIM from senders of fewer than 5,000 messages a day (as of September 2026), but Google recommends SPF, DKIM, and DMARC for every domain. A TXT record at _dmarc.example.com with the value v=DMARC1; p=none; rua=mailto:dmarc@example.com starts in monitoring mode: receiving servers are asked to take no action on failures and to send aggregate reports to the rua address.

Create or delete an address

On iCloud.com:

1. Go to icloud.com/icloudplus, select Custom Email Domain, then your domain.
2. To add, select the Add button next to your name, enter the address, then select “Add email address.” To delete, select the Remove button next to the address and follow the instructions.

On iPhone (iOS 27):

1. Go to Settings → [your name] → iCloud → Mail (under Saved to iCloud) → Custom Email Domain, tap your domain, then tap Manage Email Addresses.
2. To add, tap Create Email Address, enter the address, then tap Continue. To delete, swipe left on the address, tap Delete, then tap Remove.

Apple says mail sent to a deleted address is returned to the sender (Apple’s steps).

Family Sharing and shared domains

• Family Sharing members are added to a domain by default; you can remove them. You can share with up to five other people, and someone outside your family needs their own iCloud+ and must accept an invitation.
• Each person needs two-factor authentication and a primary @icloud.com address, and can create and delete only their own addresses.
• Only the owner adds or removes people.
• Removing someone deletes their addresses, and later mail to them is returned to the sender. Mail they already had stays in their account.
• A deleted address stays tied to the person who had it. Another member can request it, and that person has to accept.
• If you remove the domain, nobody in the group can send or receive at it in iCloud Mail.

Apple’s page on adding or removing people has the steps.

Can catch-all mail go to a separate inbox?

Not natively. iCloud has no separate catch-all folder. Your @icloud.com mail, your created addresses, and every catch-all address share one inbox, so you pick a trade-off.

iCloud Mail rules

On iCloud.com, open Mail settings as above and select Rules. On iPhone with iOS 26 or later, go to Settings → [your name] → iCloud → Mail (under Saved to iCloud) → iCloud Mail Rules → Add Rule (Apple’s iPhone steps).

The conditions are fixed: is from, is addressed to, is Cc'd to, is addressed or Cc'd to, has subject containing, and has list-id containing. A typical rule is “is addressed to” shop@example.com → “Move to Folder” Shopping. For catch-all, the limits matter:

• On iCloud.com, a value containing @ must be a complete address, so @example.com is rejected. There’s no “is not addressed to” condition and no documented domain-wide match, so in practice it’s one rule per address.
• Only the first matching rule applies to each message. You can have up to 500 rules (as of September 2026), and changes can take up to 15 minutes.
• The conditions name To and Cc only, so mail that reached you by Bcc may not match.

Forwarding to another mailbox

A rule’s “Forward to” action sends matching mail to another mailbox, which can’t be one of your own iCloud addresses. Mail Forwarding in iCloud.com’s Mail settings forwards everything, personal mail included; leave its “Delete messages after forwarding” option off until you’ve confirmed forwarding works, because deleted messages can’t be recovered.

Views that don’t move mail

In Mail on a Mac, choose Mailbox → New Smart Mailbox and add a condition that matches example.com in the recipient. The Smart Mailbox lists that mail in one place while the messages stay in your inbox (Apple’s guide). iPhone Mail’s filters and Focus filters work by account or general criteria, so they can’t single out one address.

Reading it by address in a separate app

CatchNone reads the iCloud inbox over IMAP and sorts mail by recipient without moving anything (setup below). It sees only the inbox, so moving rules and this option exclude each other; a Mac Smart Mailbox works alongside it. Each check reads only the newest 100 inbox messages from the last 30 days, so in a busy inbox, alias mail can fall outside that window if you rarely open it.

Whatever you choose, check Junk now and then. iCloud deletes messages there after 30 days, and apps that read only the inbox never see them.

Why isn’t my iCloud custom domain receiving mail?

If your iCloud custom email domain isn’t working, work down this list in order.

1. Send a test. From a non-iCloud account, write to an address you created and to a made-up one. A returned message often gives the reason.
2. Domain refused. “Someone else is already using this domain” means another Apple Account uses it with iCloud; “Finish verifying one of your domains before adding another” means an earlier domain is still unverified.
3. Record named. Check your MX record, Check your SPF record, Check your TXT record, Check your DKIM record, or Your domain records are incorrect means that record doesn’t match yet. Compare it with Apple’s email and allow up to 72 hours.
4. DNS conflicts. An old MX record remains, Cloudflare Email Routing is still on, two SPF records exist (merge them into one), or the DKIM record is proxied or flattened (Cloudflare notes).
5. Registrar format. A value was stored differently, such as your domain added twice to the host. Compare the dig output with Apple’s values.
6. Reverify prompt. “You’re currently unable to send or receive iCloud Mail, or create new email addresses, with your domain” means the records changed or the domain expired. Renew it or restore the records, then reverify.
7. Address not accepted. The address doesn’t exist and Allow All is off, the address was deleted, or it belongs to another member.
8. Storage full. New mail stops until you free space or upgrade.
9. Mail moved. Junk, a rule, or Mail Forwarding moved it.
10. Device settings. The device uses a different Apple Account, or has iCloud Mail off.
11. Apple outage. See System Status.

Apple also notes: “If your registrar has a lock on your domain, you can’t set up a domain with iCloud Mail.” Ask your registrar if records won’t save.

Reading catch-all mail by address in CatchNone

CatchNone turns your iCloud catch-all into one list per address, on iPhone, iPad, and Mac. It reads your mailbox directly from your device, read-only, so the mail never passes through CatchNone’s servers, and it never changes iCloud or your DNS. Only messages whose To, Cc, or Bcc names an address on your domain are imported, so your @icloud.com mail stays out. Mail to an address you never created shows under that address with a gray badge, so a leaked or sold address stands out; to give it a name and color tag, create an alias with that address (New Alias → Customize → Address name). The Free plan includes up to 10 aliases on your own domain, and Lite and Premium have no limit. Download CatchNone.

To connect it, choose Advanced (Bring your own domain), add your domain, and turn on Receive mail in CatchNone. Add Mailbox has no Apple sign-in, so fill it in by hand: Connection type IMAP, Mail server imap.mail.me.com, Port 993 with Secure connection (TLS) on (under Advanced settings), your iCloud Mail username (the part of your @icloud.com address before the @, as above) under Email or username, and an app-specific password under Password. Save doesn’t test the connection, so use Test connection. The app only reads, but the app-specific password itself gives full access to your mail.

CatchNone is receive-only by design, so you reply from iCloud Mail. It checks when you open it or ask it to, and personal mail counts toward the 100-message, 30-day window. Not in use is only a label on your own domain, so stop an address with an iCloud rule. If you’d rather keep signup mail out of your iCloud inbox altogether, Premium adds @catchnone.com addresses, with no domain, DNS, or mailbox to set up.

FAQ

Is iCloud Custom Email Domain free, and how many addresses can I have?

No: it comes with every iCloud+ plan but not the free 5 GB tier, and the domain is a separate cost. You get up to five domains with up to three active addresses per person on each (as of September 2026), and Allow All receives at any other address, though only created ones can send; Hide My Email is a separate iCloud+ feature, compared in Hide My Email vs email aliases.

Can I use my custom domain in Outlook or another mail app?

Yes, in any app that supports IMAP and SMTP, with the settings above and an app-specific password. On Apple devices, just turn on iCloud Mail.

Can I read my iCloud custom domain mail in Gmail?

Not by having Gmail on the web fetch it: its “Check mail from other accounts” uses POP, which iCloud doesn’t support and Google is ending. The Gmail app for iPhone, iPad, and Android can add your iCloud account over IMAP with an app-specific password. For Gmail on the web, forward from iCloud instead.

Is it a good choice for a business?

Apple calls iCloud Mail “designed primarily for personal use,” caps sending at 1,000 messages a day, and doesn’t support managed Apple Accounts. A team is usually better served by a business mail host; see the best email providers for a custom domain.

Can I bring my old email over?

Yes, on iCloud.com only, and not every provider is supported. Imported mail lands in a folder named after your old address and counts toward your iCloud storage (Apple’s import steps).