@@ -31,6 +31,15 @@ export interface SendingSubdomainProps {
    * `string` (not `string`) so it is statically knowable in `diff`.
    */
   name: string;
+  /**
+   * Whether Cloudflare keeps a preview of each sent message in the activity
+   * log (retained for about seven days). Subdomains onboarded on or after
+   * 2026-07-02 start with previews on. Omit to leave the setting as
+   * Cloudflare has it.
+   *
+   * @see https://developers.cloudflare.com/email-service/observability/logs/#message-preview
+   */
+  previewEnabled?: boolean;
 }
 
 export interface SendingSubdomainAttributes {
@@ -50,6 +59,8 @@ export interface SendingSubdomainAttributes {
   dkimSelector: string | undefined;
   /** The return-path domain used for bounce handling. */
   returnPathDomain: string | undefined;
+  /** Whether sent messages can be previewed in the activity log. */
+  previewEnabled: boolean | undefined;
   /** ISO8601 creation timestamp. */
   created: string | undefined;
   /** ISO8601 last-modified timestamp. */
@@ -73,9 +84,8 @@ export type SendingSubdomain = Resource<
  * created automatically and `enabled` flips to `true` once they validate
  * (usually immediately).
  *
- * The resource is existence-only: the API offers create, get, list, and
- * delete but no update, so changing `name` or `zoneId` triggers a
- * replacement.
+ * Changing `name` or `zoneId` triggers a replacement; `previewEnabled` is
+ * updated in place.
  *
  * Safety: sending subdomains carry no ownership markers. When there is no
  * prior state, `read` scans the zone for an existing subdomain with the
@@ -92,6 +102,16 @@ export type SendingSubdomain = Resource<
  * // sending.dkimSelector / sending.returnPathDomain — provisioned config
  * ```
  *
+ * ### Message previews
+ * **Example:** Keep no copies of sent messages in the activity log
+ * ```typescript
+ * const sending = yield* Cloudflare.Email.SendingSubdomain("Mail", {
+ *   zoneId: zone.zoneId,
+ *   name: "mail.example.com",
+ *   previewEnabled: false,
+ * });
+ * ```
+ *
  * ### Externally-hosted zones
  * **Example:** Look up the DNS records to create manually
  * ```typescript
@@ -123,7 +143,7 @@ export const isSendingSubdomain = (value: unknown): value is SendingSubdomain =>
 
 export const SendingSubdomainProvider = () =>
   Provider.succeed(SendingSubdomain, {
-    // No update API exists — every attribute is stable across updates.
+    // Only `previewEnabled` changes in place.
     stables: ["subdomainId", "zoneId", "name", "dkimSelector", "returnPathDomain", "created"],
 
     list: Effect.fn(function* () {
@@ -154,7 +174,7 @@ export const SendingSubdomainProvider = () =>
     diff: Effect.fn(function* ({ olds = {}, news }) {
       const o = olds as SendingSubdomainProps;
       const n = news as SendingSubdomainProps;
-      // The API has no update operation — any prop change is a replace.
+      // `name` and `zoneId` are identity; `previewEnabled` updates in place.
       if (o.name !== undefined && o.name !== n.name) {
         return { action: "replace" } as const;
       }
@@ -223,13 +243,20 @@ export const SendingSubdomainProvider = () =>
           );
       }
 
-      // 4. Sync — nothing is mutable; the only convergence left is DNS
-      //    validation. Cloudflare auto-creates the records on CF-hosted
+      // 4. Sync — converge `previewEnabled` when it is declared, then wait
+      //    for DNS validation. Cloudflare auto-creates the records on CF-hosted
       //    zones but validation is eventually consistent: poll briefly
       //    for `enabled` to flip, and return the observed state either
       //    way (an externally-hosted zone stays disabled until the user
       //    adds the records — that is not a deploy failure).
-      const ensured = observed;
+      const ensured =
+        news.previewEnabled !== undefined && observed.previewEnabled !== news.previewEnabled
+          ? yield* emailSending.editSubdomain({
+              zoneId,
+              subdomainId: observed.tag,
+              previewEnabled: news.previewEnabled,
+            })
+          : observed;
       const final = ensured.enabled
         ? ensured
         : yield* getSubdomain(zoneId, ensured.tag).pipe(
@@ -295,6 +322,7 @@ const toAttributes = (
   enabled: subdomain.enabled,
   dkimSelector: subdomain.dkimSelector ?? undefined,
   returnPathDomain: subdomain.returnPathDomain ?? undefined,
+  previewEnabled: subdomain.previewEnabled ?? undefined,
   created: subdomain.created ?? undefined,
   modified: subdomain.modified ?? undefined,
 });
@@ -69,6 +69,14 @@ export type SubscriptionSource =
       type: "workflows.workflow";
       /** Name of the workflow to subscribe to. */
       workflowName: string;
+    }
+  | {
+      /** Email Sending lifecycle events for one sending domain. */
+      type: "email.sending";
+      /** Zone the sending domain belongs to. */
+      zoneId: string;
+      /** The zone apex or a verified sending subdomain, e.g. `mail.example.com`. */
+      domain: string;
     };
 
 export type SubscriptionProps = {
@@ -369,6 +377,15 @@ const validateSourceAccount = (accountId: string, sourceAccountId?: string) =>
  * });
  * ```
  *
+ * **Example:** Bounces and complaints from an Email Sending domain
+ * ```typescript
+ * const subscription = yield* Cloudflare.Queues.Subscription("MailEvents", {
+ *   source: { type: "email.sending", zoneId: zone.zoneId, domain: "mail.example.com" },
+ *   events: ["message.bounced", "message.complained"],
+ *   queueId: queue.queueId,
+ * });
+ * ```
+ *
  * ### Resource and Reference Sources
  * **Example:** Account-wide KV events from a namespace
  * ```typescript
@@ -670,6 +687,8 @@ type WireSource = {
   modelName?: string | null;
   workerName?: string | null;
   workflowName?: string | null;
+  zoneId?: string | null;
+  domain?: string | null;
 };
 
 const toSource = (wire: unknown): SubscriptionSource => {
@@ -687,6 +706,12 @@ const toSource = (wire: unknown): SubscriptionSource => {
         type: "workflows.workflow",
         workflowName: source.workflowName ?? "",
       };
+    case "email.sending":
+      return {
+        type: "email.sending",
+        zoneId: source.zoneId ?? "",
+        domain: source.domain ?? "",
+      };
     case "images":
     case "kv":
     case "r2":
@@ -709,6 +734,10 @@ const sameSource = (a: SubscriptionSource, b: SubscriptionSource): boolean => {
       return a.workerName === (b as { workerName?: string }).workerName;
     case "workflows.workflow":
       return a.workflowName === (b as { workflowName?: string }).workflowName;
+    case "email.sending": {
+      const other = b as { zoneId?: string; domain?: string };
+      return a.zoneId === other.zoneId && a.domain === other.domain;
+    }
     default:
       return true;
   }
 
@@ -28,6 +28,7 @@ const NAME_REPLACE_A = `alchemy-sendsub-replace-a.${zoneName}`;
 const NAME_REPLACE_B = `alchemy-sendsub-replace-b.${zoneName}`;
 const NAME_ADOPT = `alchemy-sendsub-adopt.${zoneName}`;
 const NAME_LIST = `alchemy-sendsub-list.${zoneName}`;
+const NAME_PREVIEW = `alchemy-sendsub-preview.${zoneName}`;
 
 const resolveZoneId = Effect.gen(function* () {
   const { accountId } = yield* yield* CloudflareEnvironment;
@@ -134,6 +135,42 @@ test.provider.skipIf(!emailRoutingScoped)(
   },
 );
 
+test.provider.skipIf(!emailRoutingScoped)(
+  "previewEnabled is set on create and updated in place",
+  (stack) =>
+    Effect.gen(function* () {
+      const zoneId = yield* resolveZoneId;
+
+      yield* stack.destroy();
+      yield* purgeSubdomain(zoneId, NAME_PREVIEW);
+
+      const deploy = (previewEnabled: boolean) =>
+        stack.deploy(
+          Effect.gen(function* () {
+            return yield* Cloudflare.Email.SendingSubdomain("PreviewSending", {
+              zoneId,
+              name: NAME_PREVIEW,
+              previewEnabled,
+            });
+          }),
+        );
+
+      const off = yield* deploy(false);
+      expect(off.previewEnabled).toEqual(false);
+      expect((yield* getSubdomain(zoneId, off.subdomainId)).previewEnabled).toEqual(false);
+
+      const on = yield* deploy(true);
+      expect(on.subdomainId).toEqual(off.subdomainId);
+      expect(on.previewEnabled).toEqual(true);
+      expect((yield* getSubdomain(zoneId, on.subdomainId)).previewEnabled).toEqual(true);
+
+      yield* stack.destroy();
+    }).pipe(logLevel),
+  {
+    tags: ["provider:cloudflare", "provider:cloudflare:email", "provider:cloudflare:zone", "live"],
+  },
+);
+
 test.provider.skipIf(!emailRoutingScoped)(
   "changing the name triggers replacement",
   (stack) =>
 
@@ -5,8 +5,10 @@ import { MinimumLogLevel } from "effect/References";
 import * as Schedule from "effect/Schedule";
 import * as Cloudflare from "@/Cloudflare";
 import { CloudflareEnvironment } from "@/Cloudflare/CloudflareEnvironment";
+import { findZoneByName } from "@/Cloudflare/Zone/lookup";
 import * as Provider from "@/Provider";
 import * as Test from "@/Test/Alchemy";
+import { emailRoutingScoped } from "../Email/scope.ts";
 const { test } = Test.make({ providers: Cloudflare.providers() });
 
 const logLevel = Effect.provideService(MinimumLogLevel, process.env.DEBUG ? "Debug" : "Info");
@@ -255,5 +257,64 @@ describe.sequential(
         yield* stack.destroy();
       }).pipe(logLevel),
     );
+
+    // Creates a SendingSubdomain, which needs the Email Routing scope the
+    // rest of this file doesn't (see test/Cloudflare/Email/scope.ts).
+    test.provider.skipIf(!emailRoutingScoped)(
+      "create an email.sending subscription that keeps its zone and domain",
+      (stack) =>
+        Effect.gen(function* () {
+          const { accountId } = yield* yield* CloudflareEnvironment;
+          const zoneName = process.env.CLOUDFLARE_TEST_DNS_ZONE_NAME ?? "alchemy-test-2.us";
+          const zone = yield* findZoneByName({ accountId, name: zoneName });
+          if (!zone) {
+            return yield* Effect.die(new Error(`zone "${zoneName}" not found`));
+          }
+          const domain = `alchemy-sub-mail.${zoneName}`;
+
+          yield* stack.destroy();
+
+          const deployed = yield* stack.deploy(
+            Effect.gen(function* () {
+              const queue = yield* Cloudflare.Queues.Queue("MailQueue", {
+                name: "alchemy-test-sub-mail-queue",
+              });
+              const sending = yield* Cloudflare.Email.SendingSubdomain("MailSending", {
+                zoneId: zone.id,
+                name: domain,
+              });
+              const subscription = yield* Cloudflare.Queues.Subscription("MailEvents", {
+                source: {
+                  type: "email.sending",
+                  zoneId: sending.zoneId,
+                  domain: sending.name,
+                },
+                events: ["message.bounced", "message.complained"],
+                queueId: queue.queueId,
+              });
+              return { queue, subscription };
+            }),
+          );
+
+          const sub = deployed.subscription;
+          expect(sub.source).toEqual({
+            type: "email.sending",
+            zoneId: zone.id,
+            domain,
+          });
+
+          const live = yield* getSubscription(accountId, sub.subscriptionId);
+          expect(live.source).toMatchObject({
+            type: "email.sending",
+            zoneId: zone.id,
+            domain,
+          });
+
+          yield* stack.destroy();
+
+          yield* expectGone(accountId, sub.subscriptionId);
+        }).pipe(logLevel),
+      { tags: ["provider:cloudflare:email"] },
+    );
   },
 );