A gateway migration touches more than MX records.
Inventory first
Document inbound and outbound routes, connectors, NAT/source IPs, TLS requirements, certificates, DLP rules, allow/block policy, encryption, disclaimers, quarantine workflows, journaling, APIs and SIEM integrations.
Authentication impact
Determine where DKIM signing happens and whether either gateway modifies signed mail. Update SPF only for systems that actually become outbound SMTP sources.
Cutover
Stage DNS and connector changes, test inbound and outbound paths, preserve rollback, and monitor queues and rejections during the transition.
After cutover
Remove old relay authorization and DNS records only after proving no application or partner still depends on them.