Records only: no nameserver move. If you already publish SPF we give you a merge instruction rather than a record to paste, because a second v=spf1 at your apex breaks the mail you already send. DMARC is advisory and its reports point at your address, not ours.
Verified domains are re-checked daily. If a required record disappears the domain drops back to verifying and sends return 422 domain_not_verified naming the missing record, instead of silently going out under the wrong identity.
One limitation, stated up front: custom-domain sends cannot currently reach Outlook and Hotmail recipients. Mail from your workspace subdomain is unaffected.