SIP 403 Forbidden means the server understood your request and refuses to fulfill it. RFC 3261 adds that “authorization will not help.” The refusal is final. Retrying the same call with the same credentials will not fix it. On a voice trunk, a 403 is your carrier saying no — to your credentials, your destination, your balance, or your traffic itself.
That “authorization will not help” clause is what sets 403 apart from a normal auth challenge. For a dialer, a wall of 403s is often the moment a carrier cuts you off. This guide walks the cause ladder, cheapest rung first. It then shows how to diagnose yours, and what a 403 looks like from Asterisk and VICIdial. For the full class-by-class reference, start with the SIP response codes guide.
The five 403 causes at a glance
| What is wrong | What you see | Where the fix lives |
|---|---|---|
| Bad login or unlisted source IP | Every call fails at once, often right after a server move | Carrier portal: IP list or trunk password |
| Blocked destination | Domestic calls work while one country or number class fails | Carrier portal: destination permissions |
| Empty balance or billing hold | Every call fails, on every route | Billing portal, not the PBX |
| Policy or fraud flag | Sudden 403 wall with login and balance intact | A direct call to the carrier |
| Rejected caller ID | Failures start right after a caller-ID change | Provision the From number first |
The 403 cause ladder
RFC 3261 defines what the code means. What a 403 means on a trunk is carrier convention. Telnyx publishes a whole family of documented 403 refusals, and Twilio’s error catalog does the same. Here are the five causes, in the order they are cheapest to rule out:
-
Bad credentials or an unlisted source IP. Rule this out first. Either the registration password is wrong, or you use IP authentication and the originating box is not on the carrier’s allowed list. A new server, a new datacenter IP, or a failover to a second machine each triggers an instant wall of 403s. It lasts until the IP is whitelisted.
-
Unauthorized destination. The number you dialed is outside what your account may call. International dialing may be off. A specific country may not be on your whitelist. Or the rate deck may block premium or high-cost destinations. The tell is the pattern: domestic calls complete while one destination class fails.
-
Balance or billing block. A prepaid balance ran out, went negative, or the account is on a billing hold. Every call 403s, no matter the destination. The fix lives on the billing portal, not in your PBX.
-
Carrier policy refusal. The carrier’s fraud or acceptable-use enforcement has flagged your traffic. This is the “your account has been flagged” 403. Unusual volume spikes, high short-duration ratios, or destinations linked to fraud can all trigger it. This is the rung that ends carrier relationships, covered below.
-
Caller ID the carrier rejects. Carriers often refuse calls whose From number is unverified, not provisioned on the account, or on a do-not-originate registry. Did calls start 403ing right after you changed the outbound caller ID? Check here first.
Some carriers also return 403 for concurrent-channel and per-destination rate limits. Keep that in mind when a burst of simultaneous dials fails while single calls complete.
Diagnosing which 403 you have
The code alone does not tell you the cause. The context around it does. Work down this list. Each step either names the rung or rules it out:
-
Read the full response, not just the code. Many carriers put the real reason in the reason phrase or a custom header. “Out of funds” and “destination not allowed” are different problems wearing the same number. Pull the SIP trace before you theorize.
-
Place one manual test call. Dial a known-good domestic number from the same trunk. If it completes, credentials and balance are fine; look at destination or caller-ID rules. If it 403s too, the problem is account-level.
-
Check registration and source IP. Confirm the trunk is registered. If you use IP auth, confirm your originating IP matches what the carrier has on file. A recent server move or failover event is the classic silent cause.
-
Check the balance. Thirty seconds on the portal rules the third rung in or out.
-
Call the carrier. If credentials, balance, and destination all check out, the refusal is policy. Only the carrier can say whether it is a caller-ID rule, an AUP flag, or a fraud trigger. The answer tells you whether you are fixing a setting or finding a new carrier.
One contrast is worth internalizing: 403 is a refusal, not a failure. A carrier that is overloaded or out of routes returns SIP 503 Service Unavailable. That code is temporary and retryable. A 403 says the request was understood and denied. Retrying just documents your traffic hammering a carrier that already said no.
And if your logs show SIP 603+ (“Network Blocked”) rather than 403, that is a different story. It is an analytics block with its own FCC-mandated redress path, covered in our SIP 603 guide.
What a 403 looks like in Asterisk and VICIdial
In Asterisk’s chan_sip, the hangup-cause map (hangup_sip2cause) turns a received 403 into AST_CAUSE_CALL_REJECTED. That is ISDN cause 21, the same bucket as 401, 407, and 603. So a VICIdial or Asterisk operator often never sees “403” at the dialplan layer. They see call-rejected hangup causes stacking up in CDRs, while the real SIP code sits one layer down.
That mapping matters for triage. A spike in cause-21 rejections could be a 403, a challenge loop (401/407), or far-end declines (603). Confirm the real code with a SIP trace before you act: sip set debug on, pjsip set logger on, or a packet capture. A dialer showing thousands of rejected calls and zero answers is a trunk-level 403 until proven otherwise. The broader sequence for that symptom is in our VICIdial troubleshooting guide.
Two dialer-specific notes. First, do not re-dial 403’d calls hard. The RFC is explicit that the refusal is final. Re-dialing a policy-blocked destination at dialer speed makes the pattern that caused the block worse. Second, when a 403 flood starts mid-campaign, pause the campaign before you diagnose. Every refused attempt is logged on the carrier’s side too.
When a 403 flood means the relationship is over
Rungs one through three and five are settings. Fix the credential, fund the account, whitelist the destination, provision the caller ID. Rung four is different. A policy 403 — the fraud flag, the AUP enforcement — is the carrier telling you it no longer wants some or all of your traffic.
Sometimes that is recoverable. A real volume spike can be explained. A compromised endpoint can be cleaned up. A destination pattern can be documented. Ask the carrier what triggered the flag and what evidence would clear it.
But sometimes the answer is vague, or the account was cut without warning and support goes quiet. Then the practical read is simple: this carrier never underwrote dialer traffic in the first place, and your campaigns were living on borrowed time. At that point the fix is not a ticket. It is a carrier built for dialer traffic. And if the account is already dark, the suspended dialer account runbook is the hour-one checklist.
Preventing the 403 you cannot afford
Settings-level 403s are prevented by checklist discipline. Update the carrier’s IP list before failover events. Keep destination whitelists in sync with campaigns. Provision every outbound caller ID before it dials. Alarm on balance thresholds.
The policy-level 403 is prevented at signup, not in production. A carrier that runs KYC upfront has already underwritten your traffic profile. It asks what you dial, at what volume, and with what consent basis before it turns the trunk on. A carrier that asks nothing does its underwriting later, silently, with a fraud filter. Its answer arrives as a mid-campaign 403 flood. Bias disclosed: SIPNEX is an FCC-licensed carrier that serves dialer operations on purpose, which is exactly why we ask upfront.
Frequently asked questions
What does SIP 403 Forbidden mean?
The server understood your call and refuses to complete it. Per RFC 3261, retrying with credentials will not help. On a trunk, a 403 usually means one of five things: bad credentials or an unlisted IP, a blocked destination, an empty balance, a caller ID the carrier will not accept, or a policy flag on the account. The reason phrase and headers in the full response usually narrow it down.
Why do only my international calls return 403?
Because international dialing is off, or that destination is not whitelisted on your account. Carriers often block high-cost destinations by default to stop toll fraud. So domestic calls complete while one destination class 403s. Enable the destination, or request the specific country, on the carrier portal. Do not change anything in your PBX.
Can a 403 mean my account was flagged for fraud?
Yes. A sudden 403 on all calls, with credentials and balance intact, is often AUP or fraud enforcement. Volume spikes, high short-duration ratios, and suspicious destination patterns are common triggers. Pause the campaign. Then ask the carrier directly what flagged the account and what would clear it. Only they can say whether the block is reversible.
How does Asterisk report a SIP 403 in its logs?
As call rejected. Asterisk’s chan_sip maps a received 403 to AST_CAUSE_CALL_REJECTED, ISDN cause 21. That is the same hangup cause as 401, 407, and 603. So CDRs alone cannot separate a 403 from a far-end decline. Run a SIP trace or packet capture to confirm the real response code before you change trunk settings.
Is retrying a call that got a 403 ever the right move?
No, not with the same request. RFC 3261 says the refusal is final and authorization will not help. Automated retries only document your traffic hammering a carrier that said no. Fix the underlying cause first: credentials, IP whitelist, destination permission, balance, or caller ID. Retry only after something has actually changed.
SIPNEX holds its own FCC carrier authorization and its own STIR/SHAKEN SP certificate. We sign dialer traffic at A-level attestation, on trunks underwritten for that traffic from day one. If your current carrier’s answer to your traffic profile was a mid-campaign 403 flood, tell us what you dial. We would rather ask now than block later.
Keep reading.
The carrier built by operators, for operators.
FCC-licensed carrier with its own STIR/SHAKEN SP certificate. Operator-owned. SIP trunks built for operators who dial at volume.