STIR/SHAKEN is a cryptographic call authentication framework that lets the carrier originating your call attach a signed statement about who you are and whether you have the right to use the number in your caller ID. The carrier on the receiving end reads that statement and factors it into how the call is presented, or whether it is presented at all.
STIR/SHAKEN matters to outbound teams for one reason. Attestation level is one of the strongest inputs into carrier spam scoring, and spam scoring runs before the recipient’s phone rings. By the time anyone could decide whether to answer, the classification has already happened.
Most teams that struggle with answer rates have never asked their provider what attestation level their traffic carries. It is a single question with a concrete answer, and it frequently explains a gap that no amount of script work will close.
TL;DR
STIR/SHAKEN assigns every call one of three attestation levels. A means the originating provider verified both your identity and your right to use the number. B means it verified you but not the number. C means it verified neither, which is typical of traffic handed off from another network. Attestation is signed into a token called a PASSporT and checked by the terminating carrier in milliseconds, before the first ring.
Attestation is a trust signal, not a spam verdict. An A-attested call from a number with a complaint history still gets flagged, and a spammer who legitimately owns their numbers can earn A attestation. Chase A-level only if you place enough volume for the carrier relationship work to pay back. A small team dialing from one owned business line already has what it needs.
Key takeaways
- STIR/SHAKEN authenticates caller identity, it does not judge whether the calling itself is wanted.
- Attestation A requires the originating provider to verify your identity and your right to the specific number.
- Attestation B is the normal result for numbers sourced through resellers or shared pools.
- Attestation C carries no identity verification and is the riskiest outcome for domestic outbound.
- The framework only applies across IP-based voice networks, so legacy TDM segments break the chain.
- Terminating carriers combine attestation with their own analytics, so A attestation alone does not stop a spam label.
- Local presence dialing is compatible with A attestation, but only if the numbers are provisioned to you directly.
Table of contents
- What STIR/SHAKEN is
- Why STIR/SHAKEN exists
- How call authentication actually works
- The three attestation levels
- How attestation affects answer rates
- What STIR/SHAKEN does not do
- Why outbound teams end up at B or C
- Local presence dialing and attestation
- How to raise your attestation level
- How calling platforms handle authentication
- What to ask your provider
- STIR/SHAKEN FAQ
- The bottom line
What STIR/SHAKEN is
STIR/SHAKEN is a pair of technical standards that together let voice providers cryptographically sign outbound calls with an assertion about the caller’s identity and their authority to use the calling number. STIR stands for Secure Telephone Identity Revisited, which is the set of internet standards defining the tokens and certificates. SHAKEN stands for Signature-based Handling of Asserted information using toKENs, which is the framework for deploying STIR across real carrier networks.
The signature is not a claim that the call is welcome. It is a claim about provenance. Someone in the chain is putting their name to the assertion that this caller is who the caller ID says, and that assertion is verifiable by anyone downstream who holds the right certificate.
One structural limit is worth stating early. STIR/SHAKEN operates over IP-based voice interconnection. Where a call crosses a legacy time-division multiplexing segment, the signature does not survive, and the call can arrive at the terminating carrier unsigned even though it was properly attested at origin. That is why a technically correct setup can still show inconsistent results across destinations.
Why STIR/SHAKEN exists
The traditional telephone network had no mechanism for verifying that a caller was who the caller ID claimed. Any provider could place a call presenting any number. That single gap is what made large-scale spoofing, impersonation fraud, and neighbor-spoofed robocalling possible, and complaint volumes climbed for years before regulators forced a structural fix.
The Telephone Robocall Abuse Criminal Enforcement and Deterrence Act, known as the TRACED Act, was signed into law in December 2019 and directed the FCC to require voice service providers to implement call authentication. The full statutory text is published at govinfo.gov as Public Law 116-105.
The FCC’s implementing order set June 30, 2021 as the deadline for large originating providers to deploy STIR/SHAKEN in the IP portions of their networks. Smaller providers received extensions that have since run out, and providers must also file a robocall mitigation plan in the FCC’s public database. Traffic from providers missing from that database is subject to blocking, which is a detail worth checking if you buy wholesale minutes from a small carrier.
The practical consequence for legitimate outbound teams arrived quickly. Once attestation data became universally available to terminating carriers, it became a primary input to their spam-scoring models, and calls that could not reach A-level found themselves at a structural disadvantage.
How call authentication actually works
Your call is placed and reaches an originating provider. That provider decides an attestation level based on two questions. Can it verify the identity of the customer placing the call, and can it confirm that this customer has the right to present the number in the caller ID.
The provider then generates a PASSporT, short for Personal Assertion Token, which is a signed token carrying the calling number, the called number, a timestamp, the attestation level, and an origination identifier. It is signed with a private key tied to a certificate issued under the governance structure that administers the framework.
The token travels with the call signaling. When the call reaches the terminating carrier, that carrier retrieves the corresponding public certificate, verifies the signature, confirms the token has not been replayed or altered, and reads the attestation level. It combines that result with its own analytics data on the calling number before deciding how to present the call.
The whole exchange completes in milliseconds. By the time the recipient’s handset rings, the call has been evaluated, scored, and labeled. This is the reason spam flagging cannot be fixed downstream. The decision is made at the carrier layer, from data attached at origination, before any human is involved.
The three attestation levels
STIR/SHAKEN defines three levels, each describing a different degree of certainty about the caller and the number.
| Level | Identity verified | Right to use number verified | Typically applies to |
|---|---|---|---|
| A, full attestation | Yes | Yes | Numbers provisioned directly to a known customer by the originating provider |
| B, partial attestation | Yes | No | Reseller-sourced numbers, shared pools, some bring-your-own-number setups |
| C, gateway attestation | No | No | Traffic handed off from another network, including international origination |
Attestation A, full attestation
The originating provider has an authenticated relationship with you and can confirm you are entitled to the number you are presenting. Some carriers and handsets surface this as a verified indicator on the call screen, though the display varies by carrier, device, and operating system version, so do not treat the checkmark as guaranteed. What is consistent is that A-attested traffic starts from the most favorable position in spam scoring.
Reaching A generally requires numbers provisioned directly to your organization by the provider signing your calls, rather than numbers resold, rented from a pool, or ported in without the signing provider having verified the assignment.
Attestation B, partial attestation
The provider knows who you are and has an authenticated relationship with you, but cannot confirm your right to the specific calling number. This is the everyday outcome for businesses using number pools, virtual numbers, or inventory bought through a VoIP reseller. B-attested calls carry no verified indicator and are treated as neutral by many systems, which in practice means the number’s own reputation history does most of the work.
Attestation C, gateway attestation
The provider signing the call has no verified relationship with the originator at all and is signing only to record that the traffic passed through its gateway. International origination and multi-hop wholesale routing produce this. For domestic outbound sales calling, C attestation is a liability worth eliminating rather than tolerating.
How attestation affects answer rates
Answer rate is the share of dials that reach a live person. Everything downstream sits underneath it. Attestation moves that number through two separate channels.
The first is carrier filtering. Terminating carriers run spam models that take attestation as a significant input alongside call velocity, complaint data, and third-party reputation feeds. A B or C attested call from a number that also shows heavy volume or complaints scores far worse than an A-attested call from a clean, recently provisioned number. Calls over the threshold get labeled, sent to voicemail, or blocked outright.
The second is what the recipient sees. When a call clears filtering but arrives without verification, handsets can surface warning language on the call screen. Consumers have been trained by several years of these labels to decline anything carrying one, and that decision takes under a second.
The combined effect is not an occasional screened call. It is a persistent reduction in reachable contacts on every campaign, applied invisibly, and easily mistaken for a list quality problem. Attestation and number health are separate levers that compound, and diagnosing one without the other usually leads to the wrong fix.
Know your attestation
Find out what level your calls carry
We will check the attestation level and reputation status on your current numbers and tell you what is realistically achievable. Twenty minutes on a call.
What STIR/SHAKEN does not do
Four honest limits, because vendors routinely oversell this.
It does not certify that a call is wanted. A telemarketer who legitimately owns their numbers and has a direct carrier relationship can earn A attestation on every call. The signature says the identity is real, nothing more.
It does not override reputation data. If your number carries complaints, A attestation will not clear the label. Terminating carriers weigh both, and analytics providers apply their own labels independently of the carrier.
It does not reach every call. Calls traversing legacy non-IP segments lose the signature in transit. Coverage has improved a great deal, but it is not universal.
It does not address whether you are allowed to call. Consent, calling windows, and do-not-call obligations are a separate body of law. A call can be perfectly attested and still unlawful. Our overview of TCPA-compliant AI calling platforms covers that side, and the Federal Trade Commission publishes consumer-facing guidance on robocalls that shows how complaints enter the system your attestation is being scored against.
Why outbound teams end up at B or C
The reason is almost always how the numbers were acquired. Few contact centers buy numbers directly from a facilities-based carrier under a named business account. Numbers usually arrive through a VoIP provider, a dialer platform, or a telephony reseller, and each intermediary hop makes it harder for the signing provider to assert with confidence that your business holds the right to a given number. The default resolution of that uncertainty is B.
Number pools compound it. Rotating across many numbers is sound deliverability practice, but rotating through inventory that was previously assigned to someone else, or that was never registered to your organization with the signing provider, creates gaps where some of your traffic signs at a lower level than the rest. Teams in this position often see wide variance in answer rate between numbers in the same campaign and cannot explain it.
Recycled numbers are the sharpest version of the problem. A number previously used by a high-complaint operation carries its reputation history into the analytics databases regardless of how cleanly it is attested today. Correct attestation and poor reputation can coexist on the same line.
Local presence dialing and attestation
Local presence dialing presents a caller ID whose area code matches the recipient’s region. A prospect in Texas sees a Texas area code. Answer rates improve because a local number reads as possibly relevant rather than obviously national.
The authentication complication is direct. If a Florida business calls a Texas prospect from a Texas number, the signing provider has to confirm that business has the right to use that Texas number. Where the number was provisioned to you specifically under a carrier relationship that supports it, A attestation is achievable. Where it came from a shared pool through a reseller, B is the realistic ceiling.
So local presence and strong attestation are compatible, but only under a particular provisioning model. The question to put to any vendor is not whether they offer local presence. It is how the local presence numbers are provisioned and what level they sign at.
How to raise your attestation level
Work these in order. The first two cost nothing but a few emails.
- Ask your provider, in writing, what level your traffic signs at. Request it broken out by number if they can produce it. A provider who cannot answer is not managing this for you.
- Confirm your provider is listed in the FCC’s robocall mitigation database. Traffic from unlisted providers is subject to blocking, which no amount of attestation work will fix.
- Consolidate onto directly provisioned numbers. Numbers assigned to your organization by the provider that signs your calls are the shortest path to A. Reducing the number of intermediary hops matters more than any single configuration setting.
- Register your numbers with your provider’s account records. Where you port numbers in or bring your own, make sure the assignment is recorded with the signing provider rather than assumed.
- Separate attestation work from reputation work. Register with the analytics providers and manage call velocity in parallel. Neither one substitutes for the other.
- Measure by number, not by campaign. Track answer rate, connect rate, and flag rate per calling number so that a single bad line does not hide inside an average.
- Re-check quarterly. Provisioning changes, pools rotate, and providers change their signing arrangements. A level confirmed a year ago tells you very little today.
How calling platforms handle authentication
Platforms differ considerably here, and the difference shows up directly in answer rates at volume. A platform treating STIR/SHAKEN as infrastructure rather than as the customer’s configuration problem will offer a few concrete things.
- Direct carrier relationships. Agreements that allow properly registered numbers to sign at full attestation, which most resellers cannot arrange.
- Number registration and continuous monitoring. Numbers registered with the signing provider and with analytics databases, with reputation watched rather than assumed.
- Per-number analytics. Answer rate, connect rate, and flag rate reported by calling number so problems surface before they average out.
- Carrier registration alongside attestation. Whitelisting with the major analytics providers is a separate mechanism that works with attestation rather than replacing it.
- Automatic retirement of degraded numbers. Rotation away from a flagged line without waiting for a human to notice.
Bigly Sales handles provisioning, registration, attestation management, and reputation monitoring on the platform side rather than delegating them to the client’s team. If any of the terms on this page are unfamiliar, our AI calling glossary defines them plainly.
Here is the caveat. If you place a modest volume of calls from one or two numbers your business actually owns through a normal business line, your attestation is almost certainly already fine and this is not the constraint on your answer rate. The infrastructure work described here earns its cost at volume, across many numbers, or when you are running local presence across multiple states.
What to ask your provider
These questions separate a provider actively managing authentication from one leaving it with you.
- What attestation level does my outbound traffic receive, and can you show it per number?
- How are my numbers provisioned, directly by you or sourced through a reseller pool?
- Are you listed in the FCC’s robocall mitigation database under your own name?
- Do your local presence numbers sign at A or B, and what relationship supports that?
- What is your detection and remediation process when a number starts getting flagged, and how fast is it?
- Do you register client numbers with the major call analytics providers, and how do you evidence it?
A vendor answering “it depends on your carrier” is telling you they do not control this. That answer is fine from a reseller you chose for price. It is not fine from a platform charging for managed deliverability.
STIR/SHAKEN FAQ
What is STIR/SHAKEN in simple terms?
It is a system that lets phone providers attach a signed identity certificate to outbound calls. The receiving carrier checks the signature and uses the result, along with its own analytics, to decide how to present the call. Strong authentication makes a spam label less likely. STIR is the underlying set of internet standards and SHAKEN is the framework for deploying them across carrier networks.
What is a STIR/SHAKEN attestation level?
It is the trust rating your originating provider assigns to each call. A means the provider verified your identity and your right to use the calling number. B means it verified your identity but not your claim to the number. C means it verified neither and is signing only that the traffic crossed its gateway. A is the most trusted result and C is the least.
Does STIR/SHAKEN stop spam calls?
No, and this is the most common misunderstanding about it. The framework authenticates who is calling, not whether the call is welcome. A telemarketer who owns their numbers outright can earn A attestation on every dial. It reduces spoofing and impersonation fraud specifically, while carrier spam models use many other signals on top of the attestation result.
How do I find out what attestation level my calls get?
Ask your originating provider or calling platform directly and request the answer in writing. Enterprise platforms often surface attestation in call analytics, ideally broken out per calling number. If your provider cannot produce the figure at all, that is itself the answer, because it means nobody is actively managing authentication on your traffic.
Can local presence dialing reach A attestation?
Yes, provided the local presence numbers are provisioned directly to your organization by the provider that signs your calls. Numbers drawn from shared reseller pools normally sign at B because the signing provider cannot confirm your right to that specific number. Ask how the local numbers are provisioned rather than whether local presence is offered.
How does this relate to TCPA compliance?
They are entirely separate frameworks solving different problems. The TCPA governs whether you are permitted to place a call, covering consent, calling windows, and do-not-call obligations. STIR/SHAKEN governs whether the network trusts your identity. A call can be fully lawful and poorly attested, or well attested and unlawful. Both need managing independently.
What is the TRACED Act?
The Telephone Robocall Abuse Criminal Enforcement and Deterrence Act is the federal law signed in December 2019 that directed the FCC to require voice providers to implement call authentication. The resulting order set June 30, 2021 as the deadline for large originating providers to deploy it in the IP portions of their networks, with extensions for smaller providers that have since expired.
What happens to a call with C attestation?
It arrives with no verified identity information and is treated with maximum suspicion. Depending on the terminating carrier and the recipient’s device settings, it may be labeled as likely fraud, routed to voicemail, or blocked before ringing. For domestic outbound calling, C attestation usually indicates the traffic is being handed off through intermediaries and is worth tracing back to its source.
Is carrier registration the same thing as attestation?
No. Registering numbers with carriers and analytics providers tells those systems that a known business is behind the number, which affects reputation scoring. Attestation is a cryptographic assertion made at call time about identity and number authority. They work together, and a number that is both A-attested and registered has the best chance of arriving clean.
How often should we review attestation and number health?
Treat it as continuous rather than periodic. Attestation can change when provisioning changes, and reputation scoring updates constantly, so a number performing cleanly last week can be flagged this week. At minimum, review attestation quarterly and monitor number-level flag status weekly, with alerting rather than manual spot checks wherever your platform supports it.
The bottom line
STIR/SHAKEN is a provenance system, not a quality system. It establishes that you are who you say you are and that the number is yours to use, and it does that in milliseconds before the phone rings. That makes it a real lever on answer rates and a poor substitute for everything else that determines whether a call gets picked up.
Treat it as one of two levers. Attestation sets your starting position with the carrier. Number reputation determines whether you keep it. Ask your provider the direct question about your level, fix the provisioning if the answer is B or C, and then spend the rest of your attention on the reputation side, where most of the ongoing work actually lives.
Managed deliverability
Calls that arrive verified, not flagged
Bigly Sales handles provisioning, registration, and attestation as infrastructure. Bring one campaign and we will show you the setup behind it.
