Inventory before changing DNS
Moving mailboxes affects more than MX records. List every system that sends as the domain: mailbox providers, websites, ticketing tools, marketing platforms and automated applications. Record the envelope sender, visible From domain and current authentication method for each.
Confirm control of authoritative DNS, the old and new providers, rollback contacts and the migration window. Preserve the existing DNS records before making changes. Avoid publishing more than one SPF record for the same hostname.
Prepare both sides
Configure the new provider's supported DKIM signing and publish the required records. Update the domain's single SPF policy to account for legitimate senders while staying within protocol and provider limits. Review DMARC alignment and reports; successful SPF or DKIM alone is not the same as aligned DMARC authentication.
During a transition, old and new systems may both send mail. Remove the old sender only after confirming no legitimate workflow still uses it. Use a staged DMARC policy appropriate to the organization and its reporting capacity rather than immediately enforcing a policy you have not validated.
Test the actual journeys
Send controlled mailbox and application messages from each provider to accounts you manage. Inspect authentication results and provider logs, then test replies and inbound delivery. Account for DNS caching and record which resolver and timestamp were checked.
After cutover, monitor delivery failures and DMARC reports, retire unused credentials and remove obsolete records deliberately. A successful single test does not guarantee inbox placement for every recipient.
Further reading
Read the official documentation. For help applying these checks, explore Clouvenix services.