Changing your SPF/DKIM records during a provider switch without a delivery gap
The single most common way to break email deliverability mid-migration is DNS ordering: removing the old provider's records before the new provider's records have propagated and been verified. SPF and DKIM don't fail loudly, mail just starts silently soft-failing or landing in spam, and by the time someone notices, it's already cost you delivery for however long the gap lasted.
SPF: add, don't replace
SPF only allows one record per domain, but that record can include multiple providers. Instead of replacing v=spf1 include:_spf.oldprovider.com ~all with Envello's include, add both: v=spf1 include:_spf.oldprovider.com include:_spf.envello.dev ~all. Both providers stay authorized to send on your behalf during the transition. Remove the old include only after cutover is complete and confirmed.
DKIM: records can coexist freely
Unlike SPF, DKIM records use different selectors, so your old provider's DKIM record and Envello's DKIM record live at different DNS names (envello._domainkey.yourdomain.com vs. whatever selector your old provider used) and don't conflict at all. Add Envello's DKIM records without touching the old ones. There's no reason to remove the old provider's DKIM record until you've fully decommissioned that provider.
DMARC: doesn't need to change at all
If your DMARC policy already covers "any message that passes SPF or DKIM", which is how DMARC works by default, you don't need to touch your DMARC record during a provider switch. It's provider-agnostic by design. The one thing worth checking is your DMARC aggregate reports during the transition, so you can confirm both providers are actually passing authentication, not just assume it.
The actual sequence
- Add Envello's SPF include and DKIM records alongside your existing ones
- Wait for DNS propagation and verify Envello shows your domain as verified
- Start sending a small percentage of traffic through Envello and check DMARC aggregate reports for pass rates
- Widen the rollout once you're confident, over days not hours
- Only then remove the old provider's SPF include and DKIM record, once you've fully stopped sending through it