Why does Mail app contact iCloud when sending a non-iCloud email?

8/3/2026 at 3:49:23 PM

Fun activity: install glasswire on windows for a day or 2, set it to prompt you before any connection is allowed, and watch as about 500 different windows components attempt connections with Microsoft as a result of any and every action. And how many onedrive exes randomly fire off throughout the day despite having never once used it. And how onedrive changes its version number every day when it realizes it can’t connect.

by transcriptase

8/3/2026 at 6:03:34 PM

You’re giving me ptsd of LittleSnitch + any Adobe (or microsoft) product.

You seriously can’t even use the machine without blanket, permanent approvals… the endless flood of network requests is paralyzing.

by dd8601fn

8/3/2026 at 6:47:34 PM

MS Office doesn't need permanent approval. I have Excel, Word, Powerpoint, Autoupdate and Update Assistant blocked from making any outgoing connection (on MacOS). That works for about a month, then I have to unblock briefly to let the licence check work. I don't use Adobe these days.

by tengwar2

8/3/2026 at 8:12:03 PM

I got rid of both, not too long ago, but even trying to be careful about approving office chatter got me that read-only license check bar all the time. And getting rid of it meant clearing rules and blanket Approve for a time, or a flood of individual ones.

Also excising Adobe was not simple.

by dd8601fn

8/3/2026 at 4:37:42 PM

OneDrive is the most annoying of all the apps I never use that was installed alongside an app that I do use. Thankfully, I have now blocked it from notifying me that it can no longer connect to the mother ship.

by dylan604

8/3/2026 at 6:08:19 PM

Office apps no longer autosave unless you have OneDrive installed. So no autosave for me! Instead I save compulsively lie the days of floppy disk PCs.

(Meanwhile Emacs has had autosave since at least 1977)

by gumby

8/3/2026 at 7:08:52 PM

I remember when Adobe switched to default saving to your cloud profile rather than local. It took digging to get the default switched back to local. I know I'm old, but who wants to save large media files to a cloud like this? It's not like I'm working on a computer in one location, move to another computer entirely. Who sits at a computer to log out the cloud user just to login as yourself? You pop in a USB stick (or other storage) and use whatever account is logged in while saving back to the same storage medium. I know when you are a cloud SaaS, you want all the people to use all your things, but it always felt like a solution looking for a problem. That's a problem for me

by dylan604

8/3/2026 at 6:24:58 PM

Older office 2019 or 21 I think with massgrave.

Libreoffice.

I'm more and more relying less on office nowadays.

by 2Gkashmiri

8/3/2026 at 4:51:19 PM

Pack-in slopware and it's consequences have been a disaster for the desktop operating system duopoly.

by bigyabai

8/3/2026 at 3:59:11 PM

Probably Handoff and cross-device application state syncing.

by speak_plainly

8/3/2026 at 4:31:19 PM

Most likely answer so far. While writing an email you can take it over between iPhone, iPad and Mac. Once you hit send it probably gives a “you can stop Handoff now” signal.

by artisinal

8/3/2026 at 4:48:42 PM

I've disabled Handoff.

Also, why would Handoff be triggered by sending an email rather than composing an email? Mail app uses IMAP for syncing mailboxes.

by lapcat

8/3/2026 at 6:09:20 PM

Why would a local facility like handoff need to talk to the mother ship?

by gumby

8/3/2026 at 4:34:24 PM

One Apple Mail feature nobody here has commented on was called Piano Mover internally. I don’t know the public marketing name. It lets attachments over 10MB in emails be replaced with iCloud hosted file references.

by kridsdale1

8/3/2026 at 10:40:28 PM

I wonder if "Piano Mover" is a reference to the Goon Show episode called "Napoleon’s Piano" [1]

If you like absurdly silly comedy; Harry Secombe, Peter Sellers and Spike Milligan, you should track these down. These were made in the 1950's for BBC Radio.

[1] https://goonshow.org/goonshow/s6p4/

by VogonPoetry

8/3/2026 at 4:58:04 PM

the marketing name is "Mail Drop", and it is separate from iCloud mail; though it should only fire if there's a 20mb+ attachment on the email.

cloudd is used by a shit-ton of services though, so I'm not sure how to track it down without better tracing of what actually initiated the call, or the contents of the call.

edit: tomasf nailed it - https://news.ycombinator.com/item?id=49158388

by pinkyboy

8/3/2026 at 4:51:02 PM

I think every major email hosting provider (that's not a dumb IMAP only platform) has some variant of this.

by Onavo

8/3/2026 at 3:38:33 PM

I assume for the same reason the OS pings Cupertino when you run a binary - surveillance, masquerading as protection.

by bantunes

8/3/2026 at 3:39:45 PM

Yes, the safe assumption is that Apple reads all your mail. Not that any other provider is better---most are probably worse.

by SoftTalker

8/3/2026 at 3:43:17 PM

I don't think they read all of it. Probably just metadata. But would be good to know what's being sent.

by bantunes

8/3/2026 at 5:39:13 PM

Assume their AI agent now file system indexer is reading all your email on their behalf.

by iAMkenough

8/3/2026 at 4:31:14 PM

For a company who hangs their hat on privacy, it is a dang shame that their native mail client can't support PGP/GnuPG. I mean it'll do S/MIME, but who uses that regularly.

by zikduruqe

8/3/2026 at 4:01:37 PM

[flagged]

by tjoff

8/3/2026 at 4:23:17 PM

Figure they do it for three-letter agencies who’re not in my threat model, otherwise I’d have to spend much time busying with… Whonix? Tails? Qubes?

And lose/reimplement my Universal Clipboard and AirDrop and iMessage… (so yeah I deserve consequences of my love of convenience)

Though the more Apple fails to choose the good soap the more I should worry https://news.ycombinator.com/item?id=49074631

by Barbing

8/3/2026 at 4:42:20 PM

I don't think you have to look far nor hard for a mail-client that doesn't communicate with the developer because you send an email...

Universal Clipboard, AirDrop and iMessage - is that really the value add of apple? iMessage... do we really want to encourage that behavior?

by tjoff

8/3/2026 at 5:19:15 PM

>Universal Clipboard, AirDrop and iMessage - is that really the value add of apple? iMessage... do we really want to encourage that behavior?

I genuinely don't understand your point here, you're just listing off really awesome and useful features. Particularly iMessage, absolutely phenomenal product. What are you actually trying to convey here?

by Hugsbox

8/3/2026 at 4:49:24 PM

> Universal Clipboard, AirDrop and iMessage - is that really the value add of apple? iMessage... do we really want to encourage that behavior?

Er, yes ?

iMessage is awesome.

by spacedcowboy

8/3/2026 at 5:05:46 PM

> Universal Clipboard, AirDrop and iMessage - is that really the value add of apple?

Yes. I want my desktop and mobile systems to have a widely deployed system for beaming files and text quickly. That’s like a fundamental feature that most platforms don’t even attempt to figure out.

> iMessage... do we really want to encourage that behavior?

Yes. I want to encourage companies shipping a widely used, secure, native, cross-device messaging feature consistently over the course of almost two decades with no ads or annoying features like stories and communities.

I also wanna add that iMessage is one of the few widely used apps out there that doesn’t require a smartphone to be alive for it to consistently work. I could put the thing on a desktop in my office and use it like email if I wanted. With many of the others it is very hard to get away from the mobile experience that can be very attention grabbing.

by zer0zzz

8/3/2026 at 5:56:59 PM

A dead comment said It's previous recipients synced over iCloud. And said how to see this.[1] Vouch it if you can.

[1] https://news.ycombinator.com/item?id=49158388

by pseudalopex

8/3/2026 at 6:23:56 PM

I think this is correct, and I've now added addendums to the blog post.

by lapcat

8/3/2026 at 4:34:45 PM

Isn't this Private Relay masking your IP? https://support.apple.com/en-us/102602

The article calls out Safari but my understanding is it applies to email also.

by datakan

8/3/2026 at 4:47:29 PM

No, I don't use Private Relay or subscribe to iCloud+

by lapcat

8/3/2026 at 4:35:53 PM

Why’s this post below an older less popular one? https://i.ibb.co/jnpcFJz/IMG-0549.jpg

by Barbing

8/3/2026 at 5:52:59 PM

because rankings take other things into account, such as the time of the post

by stronglikedan

8/3/2026 at 6:50:16 PM

Time of day? (It’s newer than a lesser commented, less voted one above - at top of screenshot.)

by Barbing

8/3/2026 at 4:25:44 PM

Jeff Johnson is an Apple privacy information hero and deserves every penny for his apps like StopTheMadness https://underpassapp.com/StopTheMadness

by Barbing

8/3/2026 at 6:11:29 PM

I agree, though I don’t think it’s relevant to this post.

by gumby

8/3/2026 at 6:52:09 PM

Fair! Hope some appreciated context around author credibility nonetheless.

Also if you care about the post and its implications, you’re the target market for the app. Course these kinds of defenses are still tangential and one could stretch annoyingly.

by Barbing

8/3/2026 at 4:09:48 PM

Everyone wearing their tinfoil hat while using Gmail and drive for everything

by zer0zzz

8/3/2026 at 4:20:41 PM

Gmail doesn't pretend to be private.

by cynicalsecurity

8/3/2026 at 7:26:06 PM

It sure seems to.

> When you send an email or text message, send attachments, or record video meetings, it is stored securely in our world-class data centers. Data is encrypted in transit and at rest. If you choose to access this data offline, we store this info on your device.

> We do not scan or read your Gmail messages to show you ads

https://support.google.com/mail/answer/10434152?hl=en

by al_borland

8/3/2026 at 4:49:22 PM

> while using Gmail and drive for everything

I don't.

by lapcat

8/3/2026 at 4:55:48 PM

You’d be in the minority.

by zer0zzz

8/3/2026 at 8:09:04 PM

I don't either. My main issue is some of my recipients are so it sadly doesn't help much.

Email needs to die.

by prmoustache

8/3/2026 at 5:03:49 PM

I'd also be the author of the submitted article.

by lapcat

8/3/2026 at 5:13:26 PM

I admire your work greatly then. I definitely appreciate uncovering this sort of telemetry, but I feel the reaction from some may be a little more Tin-foil-hatted for my taste. I do thank you for doing the work though!

I also applaud you for not using the mainstream thing. That’s good too.

by zer0zzz

8/3/2026 at 4:57:17 PM

It's previous recipients synced over iCloud.

Run this and then send an email to see it: log stream --predicate 'subsystem == "com.apple.cloudkit"' --info --debug

by tomasf

8/3/2026 at 6:51:31 PM

Verified - and the actual payload to the iCloud endpoint is e2e encrypted ciphertext.

by pinkyboy