I’ve figured out what was tripping up my email domain transfers from Fastmail to iCloud+. I needed to manually change the SPF record to point to iCloud alone. For whatever reason Apple sets it to point to both services, probably out of caution.
Another domain successfully transferred this afternoon. One more to go, and I can then downgrade my Fastmail plan and leave the account to catch any stray emails for a while. (Most of those will be aliases for various sites, plus spammers scraping my WHOIS info.)