A-Level vs B-Level STIR/SHAKEN Attestation

Every outbound call you place is signed with a STIR/SHAKEN attestation level before it reaches the terminating carrier. That attestation level — A, B, or C — determines how the downstream network treats your call. It is one of the signals that decide whether the call gets flagged as spam and, in the end, whether anyone picks up.

If you operate a predictive dialer or any high-volume outbound operation, attestation level is not an abstract compliance detail. It is one of the few call-labeling inputs that your choice of carrier settles directly. Analytics engines treat partial (B) attestation as a lower-trust signal; no carrier publishes a specific answer-rate gap.

This guide explains what each attestation level means, why the difference between A and B matters, and why the carrier model — not a configuration setting — determines which level you get.

What are STIR/SHAKEN attestation levels?

STIR/SHAKEN attestation levels are the three trust grades — A (full), B (partial), and C (gateway) — that an originating carrier assigns when it cryptographically signs an outbound phone call. The level tells the terminating carrier how much the signer verified: the caller’s identity, their right to use the calling number, or neither.

STIR/SHAKEN (Secure Telephone Identity Revisited / Signature-based Handling of Asserted information using toKENs) is the framework that lets originating carriers cryptographically sign outbound phone calls. For a full technical breakdown, see our STIR/SHAKEN technical deep dive.

The three STIR/SHAKEN attestation levels at a glance:

These definitions come from the ATIS-1000074 SHAKEN standard. The FCC restates them in its Eighth Report and Order (FCC 24-120, paragraph 10).

A-level attestation (full attestation)

The originating carrier asserts three things:

1. Identity verified — the carrier has authenticated the calling party
2. Number authorized — the carrier has verified the calling party is authorized to use the specific calling number (CID)
3. Direct relationship — the carrier has a direct, verified business relationship with the entity placing the call

A-level is the highest trust signal. It tells every downstream carrier and call analytics platform: “We know exactly who is making this call, and we have confirmed they have the right to use this number.”

B-level attestation (partial attestation)

The originating carrier asserts:

1. Identity verified — the carrier has authenticated the calling party
2. Number authorization unknown — the carrier cannot verify the calling party’s authority over the specific number

B-level means the signing carrier knows its customer but cannot confirm the CID belongs to that customer. This happens structurally when the entity that signs the call (the upstream carrier) is not the same entity that assigned the number to the end user (the reseller).

C-level attestation (gateway attestation)

The originating carrier can only assert:

1. Call origin known — the carrier knows where the call entered its network
2. Identity and number unknown — the carrier cannot verify either the caller’s identity or number authority

C-level is the lowest trust signal. It typically applies to calls entering a carrier’s network from an unknown or unverified source, such as international gateway traffic.

Why the A vs B distinction matters for answer rates

Terminating carriers and call analytics platforms (Hiya, Transaction Network Services (TNS), First Orion) use attestation level as one input to their spam scoring. Here is how the distinction plays out in practice:

A-level calls start from the strongest signal. When a call arrives with full attestation, the terminating network knows the signing carrier vouches for both the customer and the number. That removes one source of risk. It does not guarantee a clean display, because call patterns and complaint history still count.

B-level calls get scrutinized. A B-level attestation tells the terminating network that something is missing — the originating carrier could not confirm number authority. The call may still go through, but it enters the terminating network with a lower trust score. Combined with high call volume, short duration patterns, or other behavioral signals, that leaves less margin before a spam label appears.

No one publishes the size of the gap. Analytics engines treat partial (B) attestation as a lower-trust signal; no carrier publishes a specific answer-rate gap. The reliable way to measure it is on your own traffic: compare answer rates on the same lists before and after a change in who signs your calls.

Real-world impact on caller ID reputation

Caller ID reputation builds up over time. Analytics engines score each number on its history: call volume, call duration, answer patterns, and complaints. Attestation is one input into that score, and no analytics engine publishes how much weight it carries.

Full attestation removes one avoidable negative signal. It does not replace the ongoing work of managing caller ID reputation.

Where B-level attestation comes from

B-level attestation is usually a byproduct of how the call is signed, not a configuration error. Under the STIR/SHAKEN certificate hierarchy, calls are signed with digital certificates, and only the carrier holding the SP certificate can sign a call — it can only assert what it has independently verified. The full signing chain is covered in our STIR/SHAKEN technical deep dive. When the signing carrier has no direct relationship with the entity placing the call, it signs at B-level, and the tier or reputation of that signing carrier does not change the math. For the full structural breakdown, see why calls routed through a reseller top out at B-level.

Does the certificate authority set the attestation level?

No. A certificate authority proves who signed the call. It does not decide how much that signer verified. Under STIR/SHAKEN, approved certificate authorities (STI-CAs) issue the Service Provider certificate a carrier signs with. To get one, the carrier first registers with the STI Policy Administrator (iconectiv) and receives a Service Provider Code token. It presents that token to an approved certificate authority, which issues the certificate.

The attestation level lives in a different place. The signing carrier sets the attest field in the PASSporT — A, B, or C — based on what it verified about the caller and the number. The same certificate signs A-level and B-level calls alike. So a valid certificate from a trusted certificate authority is required for any signed call, but it never upgrades a B to an A.

On the receiving end, the terminating carrier fetches the signer’s certificate from the x5u URL in the token. It checks that the certificate chains back to a trusted STI-CA. Only then does it read the attestation level. Certificates from an STI-CA go only to qualifying voice service providers, which is why a call center cannot fix B-level by buying one from a certificate authority — see why an Asterisk call center cannot get its own SHAKEN certificate.

How SIPNEX delivers A-level attestation

SIPNEX is an FCC-licensed carrier — not a reseller, not a CPaaS wrapper, not a white-labeled trunk from another provider. We hold our own operating authority and our own STIR/SHAKEN Service Provider certificate.

When you place a call through SIPNEX, the signing chain is:

Your dialer → SIPNEX network → STIR/SHAKEN signing (our SP-KI cert) → PSTN

For DIDs that SIPNEX assigned to your account or verified as yours, there is no intermediary: the carrier that knows the numbers is the carrier that signs the calls. Because we have a direct business relationship with you and a verified association with those numbers, we can make the full A-level assertion on them:

1. Identity verified — we authenticated you when you became a SIPNEX customer
2. Number authorized — we provisioned the DIDs to your account, or verified your right to use them
3. Direct relationship — there is no reseller in between

This is not a premium add-on; it follows from who signs the call. The limit is the caller ID itself. No carrier can honestly attest A on a number it cannot tie to you, so keep outbound caller IDs to numbers assigned or verified on your account.

What this means for dialer operators

For operators running predictive dialers or any high-concurrency outbound platform, calls from your verified DIDs leave with the strongest attestation a signer can give. Analytics engines still score volume per number, call duration, and complaints, so attestation works alongside good dialing practice rather than replacing it.

How to verify your current attestation level

If you are not sure what attestation level your calls carry, there are several ways to check:

1. Ask your carrier directly

Contact your current SIP trunk provider and ask: “What STIR/SHAKEN attestation level do my outbound calls receive?” If the answer is anything other than a clear “A-level,” or if they hedge with “it depends on the upstream carrier,” you are likely getting B-level.

2. Check the SIP INVITE headers

On a test call, examine the SIP INVITE for the Identity header. This header contains the STIR/SHAKEN PASSporT (Personal Assertion Token). Decode the PASSporT — it is signed with the originating carrier’s digital certificate — and look at the attest field:

• attest: "A" — full attestation
• attest: "B" — partial attestation
• attest: "C" — gateway attestation

3. Place a test call to a verifying endpoint

Point a DID you control at a system that verifies inbound Identity headers, then call it from your outbound trunk. Asterisk’s res_stir_shaken module can do the verifying, as covered in the Asterisk STIR/SHAKEN guide. Ask whether the carrier that delivers that DID passes the Identity header through; some verify it themselves and forward only the result. If the call crosses a non-IP hop on the way, the header can also be lost, so a missing header does not prove the call left unsigned.

4. Check your carrier’s credentials

Look up your carrier in the FCC’s Robocall Mitigation Database and read what its filing certifies: complete STIR/SHAKEN implementation, partial implementation, or robocall mitigation only. A listing alone does not prove the carrier signs your calls with its own certificate. Under the FCC’s Eighth Report and Order (FCC 24-120), a provider with a STIR/SHAKEN implementation obligation must get its own SPC token and sign with its own certificate, directly or through a third party. If your provider has no filing of its own, someone upstream is signing your calls — and likely at B-level.

5. Monitor your answer rates

A drop in answer rates with no change to your lists or dialing patterns is a reason to re-check attestation with a test call. It can also come from number labeling or list quality, so confirm what the Identity header says before you blame the signing carrier.

Attestation level and SIP trunking

Your SIP trunk provider is the entity that determines your attestation level. Not your dialer software. Not your CRM. Not your compliance vendor. The carrier that signs the call makes the attestation assertion, and that assertion is based on the carrier’s direct knowledge of you and your numbers.

When evaluating SIP trunk providers, attestation level should be a primary selection criterion — not an afterthought buried in a compliance FAQ. The two questions that settle it: does the provider hold its own STIR/SHAKEN SP-KI certificate, and does it sign calls itself rather than passing traffic to an upstream carrier for signing? Anything short of a clear yes to both means A-level cannot be guaranteed, whatever the marketing materials claim. The broader vetting checklist is in our seven questions to ask your SIP trunk provider.

Frequently asked questions

Does B-level attestation automatically mean my calls get labeled as spam?

Not automatically. B-level attestation is one factor among many that call analytics engines use to score calls, and they treat it as a lower-trust signal than A; no carrier publishes how much it moves the score. Combined with high call volume, short average call duration, or complaints, it leaves you less margin before labels appear.

How quickly will I see answer rate improvements after switching to A-level?

There is no published timeline. Caller ID reputation is partly real-time (the attestation on the current call) and partly historical (the accumulated reputation of the number). The attestation part applies from the first call signed at A. A number’s history changes more slowly, and it depends on how the number is dialed and how often people complain, not on attestation alone. Measure it on your own traffic by comparing answer rates on the same lists before and after the switch.

Is there a cost difference between A-level and B-level attestation?

At SIPNEX, A-level signing on DIDs we assigned or verified to your account comes with the trunk; it is not sold as a premium add-on. In the STIR/SHAKEN framework, attestation is not a separate product: the level follows from who signs the call and what that signer has verified about you and your numbers. Per-minute rates are on our pricing page.

Moving from B-level to A-level

If your calls are signed at B-level, the fix is structural, not a setting: move your trunks to a carrier that holds its own STIR/SHAKEN certificate, signs the calls itself, and has assigned or verified the numbers you call from.

SIPNEX is an FCC-licensed carrier with its own SP-KI certificate. Outbound calls from DIDs we assigned or verified to your account are signed directly at A-level, with no upstream carrier in the signing path.

Attestation is set at the trunk; registering the numbers themselves with the analytics engines is the other half. Which portal a business, BPO or reseller may use is sorted in the business phone number registration guide.

Talk to an operator about upgrading your attestation level →