If you're using Amazon SES and emails to @privaterelay.appleid.com are silently failing, the cause is almost certainly SES's account-level suppression list treating Apple relay DSN errors as hard bounces.

Fix: Emails Not Delivered to Apple Private Relay Addresses (Amazon SES)

If your app supports Sign in with Apple, some of your users will have a Hide My Email address — a relay address like abc123@privaterelay.appleid.com that forwards to their real inbox. These addresses are easy to break silently.

Here's the symptom we ran into and exactly how we fixed it.

The Symptom

Transactional emails (alerts, welcome emails) worked fine for regular email addresses but never arrived for users who signed in with Apple. We were also receiving bounce notifications like this:

Subject: Delivery Status Notification (Failure)

An error occurred while trying to deliver the mail to the following recipients:
prw8xms8tv@privaterelay.appleid.com

Confusingly, some of these emails were being delivered — Apple's relay occasionally returns a DSN error even on successful delivery. But over time, delivery stopped entirely for affected addresses.

Root Cause: SES Suppression List

Amazon SES has an account-level suppression list. When a send results in a bounce (even a soft or misleading one), SES adds that address to the suppression list and silently drops all future sends to it — no error, no log entry from your code's perspective.

Apple's private relay sometimes returns a non-standard response that SES interprets as a hard bounce. Once that happens:

Send to Apple relay → Apple returns DSN error → SES logs as hard bounce
→ Address added to suppression list → Every future send silently dropped

We found 9 Apple relay addresses on our suppression list, the oldest suppressed since September 2025 — meaning those users had missed months of emails.

The Fix

Step 1 — Remove suppressed Apple relay addresses

In the AWS Console:

1. Go to Amazon SES (make sure you're in the correct region)
2. Left sidebar → Configuration → Suppression list
3. Search or scroll for any addresses ending in @privaterelay.appleid.com
4. Select all → Bulk actions → Remove email address

Step 2 — Change account suppression to Complaints only

By default, SES suppresses addresses on both bounces and complaints. Since Apple relay false bounces will keep triggering this, change the setting to suppress on complaints only:

1. Stay in SES → Configuration → Suppression list
2. Find Account-level suppression (or go to General settings)
3. Change from "Bounces and complaints" to "Complaints only"
4. Save

This prevents Apple relay DSN quirks from silently killing future users' email delivery.

Checklist: Everything Else You Need for Apple Private Relay

If you're still having issues after clearing the suppression list, verify the following:

All of these must be in place. Apple's relay validates the source domain/email against your registered list after running SPF or DKIM — if either check fails, the email is rejected.

Summary

If you're using Amazon SES and emails to Apple private relay addresses are failing:

1. Check SES → Suppression list for @privaterelay.appleid.com entries and remove them
2. Change account-level suppression to "Complaints only" so Apple relay false bounces don't re-suppress addresses

That's it. Step 2 is the permanent fix — without it, the suppression list will fill up again and you'll be back to the same problem.