How to modify a Launch Daemon permanently under OS X El Capitan?

I haven't had to deal with this "for real" yet, but I think the best solution is to:

1. Copy the .plist file into /Library/LaunchDaemons.
2. Rename it (e.g. by adding "local." to the beginning of the filename), and edit its Label value to match. If you don't change this, launchd is likely to get confused between this and the original.
3. Make whatever other edits you need
4. Make sure the ownership is set to root:wheel, and permissions to 644.
5. Deactivate the original item with e.g. sudo launchctl unload -w /System/Library/LaunchDaemons/org.postfix.master.plist (the -w makes this permanent).
6. Load your customized replacement with e.g. sudo launchctl load /Library/LaunchDaemons/local.org.postfix.master.plist (or just reboot).

BTW, if you do just disable SIP and modify the existing file, it won't necessarily be reverted by an OS update. But it might, and you'd have to check after every update (including security updates, etc), which is a pain.