STIR/SHAKEN is the caller ID authentication framework used in the United States (and Canada): the originating provider digitally signs each SIP call to say how well it knows the caller and the number, and the terminating provider checks that signature. Carriers sending traffic to US numbers, including foreign carriers, need to understand attestation levels and the FCC Robocall Mitigation Database.
How it works
- The originating provider creates a signed token (called a PASSporT) with the calling number, the called number, a timestamp and an attestation level.
- The token is added to the SIP INVITE in the Identity header and travels with the call over IP networks.
- The terminating provider fetches the signer's certificate, verifies the signature and checks that the numbers match.
- The result feeds the terminating provider's call analytics, which can label, block or pass the call.
Certificates are issued by approved certificate authorities to providers that hold a token from the STI Policy Administrator. STIR is the set of IETF standards for the signature; SHAKEN is the industry framework for how carriers deploy it.
Attestation levels
| Level | Name | What the signer states |
|---|---|---|
| A | Full attestation | It knows the customer and the customer is authorized to use the calling number |
| B | Partial attestation | It knows the customer but cannot confirm the right to use the number |
| C | Gateway attestation | It is passing on a call it cannot authenticate, for example one arriving from abroad |
Calls with A attestation are the most likely to reach the phone without a spam label. Calls with B or C, or with no signature, are more likely to be flagged or blocked by analytics. Attestation does not guarantee delivery; it is one signal among several.
Key rules for carriers (as of 2026)
- US voice providers had to deploy STIR/SHAKEN in the IP parts of their networks from June 30, 2021, with later deadlines for smaller providers.
- Providers must file in the FCC Robocall Mitigation Database, describing their robocall mitigation program. Intermediate and terminating providers may not accept traffic directly from providers that are not listed. This includes foreign providers that send calls using US numbers.
- Gateway providers, the first US provider to receive a call from abroad, must authenticate unsigned SIP calls that carry US numbers, typically with C attestation, and apply know-your-upstream-provider checks.
- Since September 18, 2025, a provider with a STIR/SHAKEN obligation must sign calls with its own certificate (its own SPC token) and decide attestation itself, even when a third party does the technical signing.
Rules change often, so check the FCC's current requirements before you build a compliance plan.
What it means for wholesale buyers
- If you send calls to the US, ask your supplier how your traffic will be attested and whether they are in the Robocall Mitigation Database.
- If you display US numbers as caller ID, you should be able to show you have the right to use them. See CLI spoofing and robocall rules.
- Signatures travel only over SIP. A TDM segment in the path drops the Identity header unless a non-IP method is used. See TDM vs VoIP routes.
- Call center and dialer traffic to the US gets the most scrutiny, so expect KYC questions. See KYC between carriers.
What it does not do
STIR/SHAKEN authenticates the caller ID; it does not judge whether a call is wanted. A fully attested call can still be an unwanted robocall, and analytics engines also use call patterns such as volume, short duration and complaints. Good ASR and ACD and clean lists matter as much as the signature.
Routes to the United States
VoIPMatcher sources VoIP termination to the US from its carriers. See the United States voice destination page, or request a US voice route stating your traffic type and the caller IDs you use.
Frequently asked questions
What does STIR/SHAKEN stand for?
STIR stands for Secure Telephone Identity Revisited, a set of IETF standards for signing caller ID. SHAKEN stands for Signature-based Handling of Asserted information using toKENs, the industry framework that defines how carriers deploy those signatures. Together they let the terminating provider check that a caller ID was vouched for by the originating provider.
Does Canada use STIR/SHAKEN?
Yes. The CRTC, Canada's telecom regulator, required voice providers to implement STIR/SHAKEN on their IP networks by November 30, 2021, and Canada has its own governance authority that manages the certificates used to sign calls. Carriers sending traffic to Canadian numbers should expect the same attestation questions as for the US.
What is STIR/SHAKEN compliance?
For US providers, compliance means signing and verifying calls on IP networks, filing in the FCC Robocall Mitigation Database with a mitigation plan, and following the rules for gateway and intermediate providers. Foreign providers that send calls with US numbers must also be listed. Rules change often, so check the FCC's current requirements.
How does a provider get a STIR/SHAKEN certificate?
A US provider first registers with the STI Policy Administrator, which checks eligibility, including its FCC filings, and issues a service provider code token. With that token the provider obtains a certificate from an approved certificate authority and uses it to sign calls. Since September 2025 providers must sign with their own certificate.
Need a route?
Send the destination, route type and target rate. We reply with what we can deliver.