iCloud Mail serves Apple's consumer accounts on icloud.com, together with the legacy me.com and mac.com addresses that still deliver to the same mailboxes, and since 2021 it also hosts custom domains for iCloud+ subscribers. Spaw reports all of them as mx_provider: "icloud".
How iCloud shows up in DNS
Every iCloud-hosted domain publishes the same pair of MX records, mx01.mail.icloud.com and mx02.mail.icloud.com, both at priority 10. Apple's setup guide for custom domains uses exactly these two hosts. Spaw matches the .mail.icloud.com suffix. iCloud is a mailbox host: the MX target is Apple's own inbound server, mx_found is true and mx_implicit is false.
How iCloud answers a verification handshake
Apple's inbound servers typically reject unknown recipients at RCPT TO, so a missing icloud.com mailbox is confirmed in the session. They are also strict about sender reputation and will defer or drop connections from sources they distrust, which occasionally leaves a probe unverified with smtp_reason: greylisted or no_connect. Custom domains on iCloud+ can enable a catch-all address from the iCloud settings, and those domains then answer as catch-all.
What that means for your verdicts
For icloud.com, me.com and mac.com, Apple's username rules apply before any probe: letters, digits, dots, underscores and hyphens. Anything else is undeliverable with reason: invalid_local_part without a handshake. Valid addresses are probed and mostly come back deliverable with mailbox_exists: true or undeliverable with reason: mailbox_not_found and smtp_reason: no_mailbox.
An ordinary icloud.com, me.com or mac.com address is a real mailbox at a free provider, and Spaw answers it with free_provider: true, domain_category: "webmail" and is_relay: false.
Apple has two alias features, and they answer differently. When an app offers Sign in with Apple and the user chooses to hide their address, the app receives a random address on privaterelay.appleid.com, and Apple forwards only the mail sent from the domains and addresses the app's developer registered with Apple. Apple said in August 2026 that new addresses will be issued on private.icloud.com from later that year, and that existing ones keep working. Spaw flags both domains: is_relay: true, relay_service: "Sign in with Apple private relay" and domain_category: "relay". The flag belongs to the name private.icloud.com alone, so an icloud.com address never inherits it. Hide My Email in iCloud+ is the other feature, and its aliases sit on icloud.com itself, beside the real mailboxes, where Apple's August 2026 announcement keeps them. Nothing in the address or the domain marks one as an alias, so Spaw cannot tell it from an ordinary iCloud mailbox and does not flag it: it answers like any other icloud.com address. Both kinds forward to a real inbox until the user turns them off.
Custom domains with catch-all enabled answer risky with reason: catch_all and a mailbox_confidence estimate; iCloud is not on the established-provider list, so the estimate relies on the domain's own records, its age and the shape of the username.
SPF and DMARC at iCloud
For custom domains, Apple's guide publishes v=spf1 include:icloud.com ~all for SPF, a DKIM CNAME with the selector shown during setup, and a DMARC record. icloud.com itself publishes SPF and a DMARC policy, so From addresses at icloud.com sent through other services fail alignment. Spaw reports the live state of any domain in has_spf and dmarc_policy.
Practical notes for sending to iCloud users
Apple's Mail Privacy Protection loads remote content through Apple's proxies, which makes open rates for iCloud users unreliable and makes engagement data a poor substitute for verification. Legacy me.com and mac.com addresses are still live for the accounts that had them, so do not discard them on age alone; verify them. iCloud does not use Gmail-style plus-addressing for consumer accounts, and role-style usernames on icloud.com are individual accounts rather than shared inboxes, though Spaw still applies its role-word list to them.
For a live look at any iCloud-hosted domain, run it through the free MX lookup and the SPF and DMARC checker.