Has anyone seen Protect Mail Activity get re-enabled after you've disabled it? I wrote about that a few days ago: https://lapcatsoftware.com/articles/2026/6/6.html

Not for me. I don’t even remember when (or since how many years ago) I turned off Protect My Email and turned on both Hide IP Address and Block All Remote Content. I still have these toggles as they are, despite the fact that I use beta releases as and when they’re released (currently still on iOS 26.x).

Fetching any email content is always worse than blocking it, because the typical threshold for spam is "is this inbox monitored". If that is true, then blast it with spam. And fetching anything ever proves that the inbox is monitored.

At least in Gmail, downloading content (e.g. images) is disabled by default for suspicious emails. There is no way for the sender to know if it’s monitored unless this is disabled by explicit user action.

This freaked me out the first time I used Mail. It rendered a PDF about buying bitcoin on PayPal (I don't have PayPal). Looked at the same email in Gmail and Thunderbird, it's just a PDF attachment, no message, and the sender was different. No wonder people are falling for those scams, Mail makes it easy for them.

Now if only I had a better client on my phone (never buying an iPhone again)

What made you prefer Mail to Gmail, given you don’t seem satisfied with Apple’s Mail app?

I prefer Thunderbird

My impression as a Mutt user (which never downloads linked content) is that spammers don’t really care about whether an inbox is “monitored” or not.

I’m still mildly annoyed every email I send using Mail has my IP embedded in it

Source? I don't think this is true. Doesn't seem to be the case for me. Maybe your email provider attaches your IP address?

It’s in the headers. Send an email to your self from Mail and open the source in the inbox. There is your IP.

Is this from iOS? I just tested from MacOS, and the only IPs were for the transit and auth servers.

I'm not actually doubting it. saagarjha knows his stuff. I just don't see it, so maybe I'm holding it wrong.

Same, I remember it being in the headers long ago but don't see it now. macOS Tahoe, Mail.app client, iCloud email sending to itself or to my Gmail, both set up in default ways, IPv6 disabled

From what I see above, it looks like the trick is to send from Mail.app to an account read by a different app (maybe just Gmail?).

I would need to test with my hosting Webmail client, so maybe tomorrow.

See my comment here: https://news.ycombinator.com/item?id=48758444.

I saw that, in my headers, but in my case, it was not an IP in any subnet of mine.

I’ll mess around, today, and see what comes up.

I also just tried this as well, sending an email from a Migadu-based account to one at both Gmail and MXRoute using Mail.app under macOS 15.7.7. Neither included any private IP address info I could find in either headers or raw source. That would be a good leak to know about and as sibling comment said saagarjha definitely knows their stuff, so any tips to replicate would be appreciated.

Received: from smtpclient.apple (ptr. [ip]) by smtp.gmail.com with ESMTPSA id ... for <...> (version=TLS1_2 cipher=ECDHE-ECDSA-AES128-GCM-SHA256 bits=128/128); Thu, 02 Jul 2026 ..:..:.. -0700 (PDT)

Using Mail: Version 16.0 (3864.600.51.1.1).

Sent from a Google Apps mail.

For me that IP belongs to apple, when using the iOS mail client. I presume Apple forces third party apps to use their API and then stuff like this happens. Guess that's also on google, not mitigating that issue, tho.

Have you tried a VPN? I wonder, if Apple manages to expose IP despite a VPN. They had issues with stuff like that before.

That Received header is inserted by smtp.gmail.com (Google), not Apple.

Seems like this is a Gmail thing: https://ylukem.com/blog/apple-mail-leaks-your-ip-address

It's not a Gmail thing:

> The reason why my IP address is visible is because Apple Mail sends emails with SMTP.

Unless you use a proxy, your IP address is visible to an SMTP server, just like it's visible to an HTTP server when you use a web browser. This is not specific to Apple Mail or to Gmail.

Yeah but I think Gmail seems to actually just keep that header rather than nuking it. To be fair I don't entirely know what I would do to fix it since (like the post) this seems like there aren't many good options here.

Gmail's SMTP servers are what's adding the received header with your IP address, not Apple Mail.

> I think Gmail seems to actually just keep that header rather than nuking it.

I think that's common among email providers.

Yes, was able to repro just now

I clearly remember many years ago that this wasn’t the case with Gmail, when looking for the source IP address in a case involving harassment of a person. I could only get Gmail’s own IP address in the headers from the multiple emails I examined at that time.

Nevertheless, as js2 said in another comment, it’s your mail provider (in this case Gmail) deciding whether to include the sender’s IP address or not.

Why? Something real, or just nonspecific vibes?

This is your email provider doing this. I use Fastmail. Fastmail does not log the IP of the sender when you use its SMTP servers.

right.

I am starting to think all these "privacy" features merely exist as excuse for getting people to hand off their mails to Apple. Clearly the all do not deliver on the intended functionality, but the proxy/relay routing happens to some extent anyway. How convenient. If you were a company promising its users all the privacy, but secretly not giving a fuck beyond collecting user traffic and meta data, wouldn't you expect the state of things to look exactly like that? I mean, how could you explain this any other way, considering the size of Apple and the relative ease of developing such features reliably? Apple is hardly breaking ground here.