wait_timeout_seconds runs out. A DNS error counts as “not yet”: it changes nothing, and the next check runs as normal.
The resource stays in state only while the domain is verified. If re-checks stop finding the record (the domain lapses) or the claim goes back to pending, the next plan verifies again. Destroying it changes nothing on the server; removing the claim is sazabi_sso_domain’s job.