STIR/SHAKEN: the operator's guide — from a carrier that signs its own calls.
Most STIR/SHAKEN content online is written by consultants, resellers, or CPaaS platforms that don't hold their own certificate. SIPNEX is the actual licensed carrier signing your calls with its own SP-KI keys. Every section below is implementation, not theory.
What STIR/SHAKEN actually is.
STIR/SHAKEN — also written SHAKEN/STIR or STIR SHAKEN — is a caller ID authentication framework. It lets the originating carrier cryptographically sign each outbound call, so the terminating carrier can verify the caller is authorized to use the number displayed.
STIR — Secure Telephone Identity Revisited — is the IETF framework for cryptographically signing caller ID information. The framework is specified in RFC 8224, RFC 8225, and RFC 8226.
SHAKEN — Signature-based Handling of Asserted information using toKENs — is the ATIS/SIP Forum implementation that actually delivers STIR over SIP trunks. When people say "STIR/SHAKEN" they usually mean the SHAKEN profile running on production carrier networks, which is what the Federal Communications Commission (FCC) has mandated for US carriers since June 2021. The tortured acronym is deliberate, by the way — a nod to James Bond's "shaken, not stirred."
The goal is narrow: verify that the phone number shown on an outbound call belongs to a caller who has the right to use it. It is the industry's direct counter to caller ID spoofing. The originating carrier authenticates the calling party, then signs the call with a private key tied to its Service Provider certificate — a standard X.509 digital certificate issued by one of the approved STI certificate authorities, not something a carrier can mint for itself.
On the receiving side, the roles flip to verify the calling identity. The terminating carrier retrieves the certificate's public key, validates the signature, and reads the attestation level the originator claimed. The signed token carries additional information beyond the number itself — including a unique origination identifier that supports industry traceback of bad traffic. The phone then displays — or blocks — accordingly.
What STIR/SHAKEN is not: it's not a consent mechanism, not a do-not-call replacement, not TCPA compliance, not a magic box that makes answer rates go up regardless of who you're calling. It's one layer of a multi-layer trust system. Treating it as anything more is a mistake.
Where STIR/SHAKEN stops.
- IP networks only — Calls that cross legacy TDM or other non-IP segments lose the signature. The FCC requires those providers to upgrade or develop alternatives, but the gap is real today.
- Authority, not legality — Attestation verifies number authority. It says nothing about the legality or content of the call itself.
- Display varies — Treatment differs by terminating carrier and handset. A-level attestation is necessary for good display, not sufficient.
- International traffic — Calls entering the US through gateways typically arrive at C-level, whoever originated them.
One extension is coming next: Rich Call Data (RCD). It extends the STIR/SHAKEN PASSporT to carry a display name, a logo, and a call reason alongside the attestation. The industry is still rolling it out, and handset support varies by carrier. Treat it as direction, not a feature anyone can fully deliver today.
So the fix is real, but it is not the whole fix. The right way to read the rest of this page: the standard sets the floor, and your carrier sets what you get from it.
A, B, C: the three levels nobody explains clearly.
Every signed call carries an attestation level. Your answer rate depends on it. Here's what each level actually means — and which one SIPNEX delivers.
The grade is not about how good your leads are or how clean your script is. It is about what the carrier that signs the call can prove.
Full attestation
WHAT SIPNEX DELIVERSOriginating carrier has direct customer relationship AND verified the caller has authority to use the phone number.
Terminating carriers display 'Verified Caller' with a checkmark. Highest answer rates.
Partial attestation
Originating carrier has direct customer relationship but cannot verify phone number authority.
Neutral or unverified display. Measurable answer-rate drop vs A.
Gateway attestation
Originating carrier received the call from another network. Cannot attest to origin at all.
Frequently displayed as 'Scam Likely' or 'Potential Spam.' Significant answer-rate penalty.
The same three levels, side by side:
| LEVEL | NAME | WHEN IT'S GIVEN | WHAT THE PHONE SHOWS | ANSWER-RATE IMPACT |
|---|---|---|---|---|
| A | Full attestation | Originating carrier has direct customer relationship AND verified the caller has authority to use the phone number. | 'Verified Caller' with a checkmark | Highest answer rates |
| B | Partial attestation | Originating carrier has direct customer relationship but cannot verify phone number authority. | Neutral or unverified label | Measurable drop vs A-level |
| C | Gateway attestation | Originating carrier received the call from another network. Cannot attest to origin at all. | 'Scam Likely' or 'Potential Spam' overlays | Significant answer-rate penalty |
Here is the short version. An A means the carrier knows you and knows your number. A B means it knows you, but not your number. A C means it just passed the call along. The phone at the far end reads that grade and picks what to show. That choice drives how many of your calls get picked up.
The reseller ceiling is B-level, and nobody tells you.
Most "VoIP providers" you can buy a SIP trunk from are not carriers. They're resellers or CPaaS platforms sitting on top of an actual carrier. The call path looks like this:
The problem is that the upstream carrier signing the call has a relationship with the reseller — not with you. It doesn't know your business. It doesn't know which numbers you're authorized to use. It can't verify number authority on your behalf. So it signs at B-level — "I know my reseller customer, but I can't attest to their customer's phone number authority."
B-level is the ceiling for calls originated through a reseller. You can have perfect TCPA compliance, clean DNC scrubbing, legitimate consent — it doesn't matter. The signature will still say B because the carrier holding the pen doesn't have the information needed to sign A.
This is why most dialer operators report a mysterious answer-rate drift as their volume scales. It's not mysterious. It's the attestation ceiling catching up with their call patterns.
There is a quick way to test this. Ask your provider one question: who signs my calls? If the answer is "our upstream does," you have found your ceiling. The pen is not in their hand. No plan tier, no add-on, no support ticket can change that.
We hold the certificate. We sign your calls ourselves.
SIPNEX is the licensed carrier in the call path. Not a reseller wrapper. Not a CPaaS abstraction over someone else's trunk. Our name is on the FCC filing. Our private key is on the signature. The company holding both is operator-owned SIPNEX Telecom.
That means three things your current provider probably can't offer:
- Direct A-level attestation — Because the direct customer relationship is with you (not with a middleman), we can attest to your authority over the phone numbers you dial from.
- Direct RMD filing — We're in the Robocall Mitigation Database as a primary filer, not under an umbrella.
- Signature reputation we own — Our SP-KI reputation is ours to protect. We actively manage it. Bad actors don't last on our network because the reputational cost is on our company, not some distant upstream.
How a call gets signed, in seven steps.
Here is the full path a call takes on our network, from the first packet to the screen:
- Your dialer sends the SIP INVITE to SIPNEX.
- We check the caller ID number against your verified number authority.
- We create a PASSporT — a signed JSON web token carrying the attestation level, origin number, destination, and timestamp.
- The PASSporT goes into the call's SIP Identity header, signed with our SP-KI private key.
- The call routes to the terminating carrier.
- That carrier fetches our public certificate and validates the signature chain back to an approved STI-CA.
- The handset displays "Verified Caller," a neutral label, or a spam warning based on the attestation.
The signature only counts because of the chain of authorities behind it. Three bodies govern who gets to sign:
- STI-GA — the governance authority. It sets the rules for who may obtain a signing certificate.
- STI-PA — the policy administrator. It issues the tokens carriers use to request certificates.
- STI-CA — the approved certificate authorities. They issue the SP certificates carriers sign with.
Resellers rent a place in this chain. SIPNEX holds its own SP-KI certificate inside it.
Why should you care about the chain? Because trust flows down it. A signed call is a claim, and the chain is what makes the claim worth something. When we sign your call, our name is on the line — not a vendor two hops up. That is the whole pitch, and it is easy to check.
How caller ID authentication became law.
None of this was optional. Congress passed a law, and the FCC turned it into hard dates:
- DEC 2019 — TRACED Act signed, directing the FCC to mandate call authentication.
- MAR 31, 2020 — FCC adopts rules requiring STIR/SHAKEN caller ID authentication.
- JUN 30, 2021 — Implementation deadline for large US carriers.
- 2022–2023 — FCC extends obligations to gateway and intermediate providers.
FCC Robocall Mitigation Database.
Every US carrier is required to be listed in the FCC's Robocall Mitigation Database with a filed robocall mitigation plan. SIPNEX is a direct filer. Our plan covers number authority verification, suspicious traffic detection, customer vetting, and incident response.
Read our mitigation approach →STIR/SHAKEN is not TCPA.
A-level attestation doesn't make your campaign TCPA-compliant, and TCPA compliance doesn't give you A-level attestation. They operate at different layers. You need both: the right carrier signing your calls, and your own policy for consent, DNC, and calling hours.
TCPA compliance guide →About STIR/SHAKEN implementation.
Short answers to the things buyers ask us most. Each one is the real rule, not the sales gloss.
What is STIR/SHAKEN?
What does 'attestation level' mean?
What's the difference between A, B, and C level attestation?
Why does attestation level matter for my answer rate?
Does SIPNEX provide A-level attestation?
Do I need to file anything with the FCC as a SIPNEX customer?
How does STIR/SHAKEN interact with TCPA compliance?
What happens if I try to spoof caller ID on your network?
What does a STIR/SHAKEN PASSporT contain?
Does STIR/SHAKEN work on landlines and non-IP networks?
Who issues STIR/SHAKEN certificates?
Stop accepting B-level as the ceiling.
If your current answer rate feels capped and you can't figure out why, the answer is usually in the attestation your carrier can give you. Move to a carrier that holds its own certificate. Move to SIPNEX.