Characterize the old system

List every transactional and campaign stream, trigger, tenant, From/Reply-To/return-path, DKIM selector/domain, SPF authorization, IP/pool, template/MIME, volume/rate, localization, attachment, link/tracker, bounce/complaint/unsubscribe path, suppression source, webhook, retry, event definition, retention, and owner.

Capture representative message originals and provider events as regression fixtures with personal data removed. Record current performance and known defects so they are not attributed to the move.

Review the new contracts

Map API/authentication, idempotency, rate/quota, timeout/retry, error taxonomy, event/webhook signature/replay behavior, suppression semantics, data region/retention, subprocessor, export/deletion, and incident support. Store credentials in a secret manager with least privilege and rotation.

Do not make browser calls directly to the provider or expose keys. Queue sends and process webhooks idempotently.

Stage additive identity

Verify provider accounts/domains, publish a new DKIM selector, configure custom return path/SPF if needed, and confirm DMARC alignment. Keep old selectors/authorization while the old system sends. Import suppression through a reconciled, reversible process; never let the new provider start with only active contacts.

Prove workflows end to end

Trigger each real application flow with authorized test accounts. Validate queue, template, Unicode, links, attachments, headers, authentication, SMTP acceptance, mailbox observation, bounce, complaint, unsubscribe, webhook, retries, idempotency, and outage behavior. Compare old/new metric definitions.

Cut over and roll back by cohort

Assign each event/recipient to exactly one provider. Define cohort, rate, success gates, stop conditions, and rollback. Monitor queues, provider errors, recipient-provider responses, authentication, complaints, suppression lag, and support. Prevent duplicate sends during rollback.

Retire deliberately

After stability and rollback rehearsal, stop old jobs, revoke old credentials, preserve required suppression/audit data, retain old DKIM keys for overlap, and later remove obsolete SPF records. Update inventories and runbooks.

The migration is complete when every stream and feedback path has evidence, old access is revoked, and rollback was tested—not when the new provider accepted its first API request.