01Before the first send
The links go out on your domain, not the vendor’s
A CNAME and a TXT record at your DNS provider, and every link in every sequence is served from a hostname with your name on it.
The certificate is issued and renewed for you. When the tooling changes, this does not — which is the whole point of doing it before the first send rather than after the migration.

