Skip to content

Comment on Apple 'Hide My Email' vulnerability reveals peoples' real email addressesparent

Comments

I also just tried this as well, sending an email from a Migadu-based account to one at both Gmail and MXRoute using Mail.app under macOS 15.7.7. Neither included any private IP address info I could find in either headers or raw source. That would be a good leak to know about and as sibling comment said saagarjha definitely knows their stuff, so any tips to replicate would be appreciated.

Received: from smtpclient.apple (ptr. [ip]) by smtp.gmail.com with ESMTPSA id ... for <...> (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 02 Jul 2026 ..:..:.. -0700 (PDT)

Using Mail: Version 16.0 (3864.600.51.1.1).

Sent from a Google Apps mail.

For me that IP belongs to apple, when using the iOS mail client. I presume Apple forces third party apps to use their API and then stuff like this happens. Guess that's also on google, not mitigating that issue, tho.

Have you tried a VPN? I wonder, if Apple manages to expose IP despite a VPN. They had issues with stuff like that before.

That Received header is inserted by smtp.gmail.com (Google), not Apple.

AboutSource Built by g1lg1l

Hackerly is an independent reader for Hacker News, built on the public HN API. Not affiliated with Y Combinator.