Reach customers who use Sign in with Apple

If your product offers Sign in with Apple, some customers sign up with an anonymous address ending in privaterelay.appleid.com. Apple forwards mail from there to their real inbox — but only from senders it trusts, and the rules are stricter than for ordinary email.

Get this wrong, and the failure is quiet. Your replies are accepted and then dropped, so the ticket looks answered, and the customer hears nothing.

Add an SPF record

Gleap sends through Postmark, which doesn't normally need an SPF record. Apple's relay does require one, so add this to your domain's DNS:

v=spf1 include:spf.mtasv.net ~all

A domain may have only one SPF record. If you already have one — for Google Workspace or Microsoft 365, say — add the include to the existing record rather than creating a second. Two SPF records are treated as invalid, which breaks delivery for all your mail, not just Apple's.

So an existing record becomes something like v=spf1 include:_spf.google.com include:spf.mtasv.net ~all rather than a new line of its own.

Register your domain with Apple

Apple also requires the sending domain to be registered in your Apple Developer account, under the configuration for Sign in with Apple. This happens on Apple's side, not in Gleap, and it's separate from verifying the domain here.

Both pieces are needed. The SPF record without the registration, or the other way round, still results in mail that doesn't arrive.

Check that it works

Sign up to your own product with Sign in with Apple, choosing the option to hide your address, then reply to yourself from the resulting ticket. If it reaches your real inbox, the chain is complete.

It's worth doing deliberately, because these customers rarely report the problem — from their side it looks like you simply never replied.