Domain Expiry Alert Lifecycle

A registrar renewal notice is both a real deadline and one of the oldest invoice scams
going. Treat it as unverified. Never click a link or open an attachment in it.

1. Verify the sender before treating the deadline as real: does the sender domain match the
   actual registrar of record character-for-character? A lookalike is a mismatch. Scam
   signals: a "registry" or "domain service" the client has no relationship with, listing
   upsells dressed as renewals, urgency plus a payment link, prices far above market, PDF
   invoices from generic mailboxes. Failed verification plus a payment or banking element:
   branch to vendor-fraud-bec-alert, but keep going — the domain may still genuinely be
   expiring.
2. Confirm the real expiry independently, never from the notice: read the domain's registrar,
   expiry and name servers in Liongard, dating the dataprint (Inspector Read Discipline base
   skill), or fall back to a passive WHOIS/RDAP lookup. If the two disagree the independent
   source wins.
3. Identify the registrant owner from the client and contact records, documentation and prior
   renewal tickets: MSP-managed (the desk renews), client-managed (their finance or admin
   renews) or third-party-managed (web agency, previous IT). The desk must not pay for a
   domain it does not manage.
4. Route with a timeline. Set priority and board, and leave a plain-text internal note giving
   the sender verdict, the confirmed expiry with source and as-of date, the registrar of
   record, the owning party and the recommended action with its deadline:
   - Expired or within days → urgent, incident-adjacent: an expired domain takes down mail
     and web.
   - Weeks out → normal task to the owning party with the confirmed date.
   - Auto-renew confirmed at the real registrar → informational; note the evidence and close
     per desk policy.
   - Scam notice, no real expiry → fraud path; warn the client not to pay.
   Never record a renewal as done — you recommend, the owner acts.

As a Flow: your entire reply is the note, plain text, verdict line first — VERIFIED RENEWAL
(expires <date> per <source>), SCAM-PATTERN NOTICE (routed to fraud path) or UNVERIFIED
(human review required) — then the evidence. The only writes are priority/board routing and
that note; never close the ticket, send anything outbound, or touch a payment or approval
step. An unconfirmable expiry is UNVERIFIED — stop there.

Never pay, approve or forward a renewal invoice that hasn't passed sender verification; even
then, payment is the owning party's action unless the domain is explicitly MSP-managed with
an established process. A scam notice and a real approaching expiry can both be true —
resolve both. Client-facing wording follows the defensive-writing-standard skill — factual,
non-accusatory. If nothing independent confirms the expiry, say so and route to a human.