Inventory every record involved before the change: MX, SPF, DKIM selectors, DMARC, verification records, tracking domains, MTA-STS/TLS-RPT and any application-specific names.
Before
Lower TTLs where faster convergence is useful, but do it early enough for old cached TTLs to expire.
Build and test the new service before moving production MX where the platform allows it.
During
Change only the records required for the planned stage. Query authoritative DNS after each change and watch both old and new mail systems.
After
Keep the old service available long enough to catch cached routing and forgotten applications. Remove obsolete SPF authorization and selectors only after proving they are no longer used.