STIR/SHAKEN Caller ID Authentication

STIR stands for Secure Telephone Identity Revisited. It is the set of IETF standards that define how a digital signature is created and attached to a call.

SHAKEN stands for Signature-based Handling of Asserted information using toKENs. It is the ATIS specification that tells carriers how to actually deploy STIR across their networks.

The short version: STIR is the standard, SHAKEN is the deployment framework built around it. In practice the two are always referenced together, which is why the STIR/SHAKEN protocol is usually treated as a single thing.

Three steps, all of them finished before the recipient's phone rings.

Authentication. Your provider checks who is placing the call and whether they have the right to use the number on the caller ID. Signing. The provider adds a signed SIP Identity header to the call, carrying its certificate and an attestation level describing how confident it is. Verification. The terminating provider validates that signature against the originating provider's certificate and passes the result to its own spam analytics.

What the recipient actually sees at the end of that chain is up to their carrier. STIR/SHAKEN supplies the evidence; the carrier's analytics engine makes the call.

Every signature carries an attestation level saying how much the originating provider actually knows about the call. There are three.

Full attestation (A): the provider knows the customer and has confirmed they are entitled to use the number. This is the level most likely to reach the recipient unlabeled. Partial attestation (B): the provider knows the customer but has not verified their right to that specific number, which is common when a business brings its own numbers. Gateway attestation (C): the provider is only passing the call along and cannot vouch for its origin at all, which is typical for international traffic entering the US network.

Carrier analytics weight these heavily. A calls generally sail through, C calls attract scrutiny. If your outbound answer rates are poor and you cannot work out why, your attestation level is one of the first things worth checking with your provider.

In the United States, yes. Under the TRACED Act, the FCC adopted rules in 2020 requiring voice providers to implement STIR/SHAKEN across the IP portions of their networks by June 30, 2021. Small providers with 100,000 or fewer subscriber lines were granted an extension to June 30, 2023, later shortened to 2022 for a subset originating high call volumes. The obligation has since been extended to gateway and intermediate providers as well.

Providers also file certifications in the FCC's Robocall Mitigation Database, and since September 2021 carriers have been barred from accepting traffic directly from providers that are not listed in it. Canada operates a parallel requirement through the CRTC.

Worth knowing if you are the one making the calls rather than carrying them: STIR/SHAKEN compliance is an obligation on your voice provider, not on your business. You do not file anything. But your provider's implementation directly determines how your calls are treated, which makes it a fair question to ask any vendor you are evaluating.

Not directly, and this is the most common misunderstanding about it. STIR/SHAKEN authenticates caller ID. It makes no judgment about what a call is for. A perfectly legal robocall with full attestation passes through untouched, and a scammer can still place a spoofed call. The call just arrives carrying an honest label saying nobody can vouch for it.

What the framework does is remove anonymity from the network. Because every signed call can be traced back to the provider that originated it, regulators and carriers can identify repeat offenders instead of chasing untraceable traffic, and carriers get a reliable signal to filter on. Fighting STIR/SHAKEN robocalls is a byproduct of that traceability rather than the mechanism itself.

Because attestation is one input among many. Carrier analytics engines also weigh how many calls a number places per day, how long those calls last, how often they are answered, how many recipients have reported the number, how recently it was activated, and whether it appears in the analytics providers' registries.

A brand new number dialing three hundred times a day with an average duration of four seconds looks exactly like a robocaller, and full attestation will not save it. That is a dialing behavior problem, not a signing problem.

The things that actually move the needle: register your numbers with the analytics providers, spread volume across enough numbers that no single one looks frantic, keep an eye on your average call duration, and add Branded Caller ID so recipients see who is calling rather than an unfamiliar string of digits.

STIR/SHAKEN is verification. It runs between carriers, the recipient never sees it, and its job is to tell the receiving network that your call is what it claims to be.

Branded Caller ID is display. It puts your company name, and on supported handsets your logo and a reason for calling, on the recipient's screen. Its job is to give a human a reason to pick up.

They solve adjacent halves of the same problem and work best together: signing gets your call past the filter, branding gets it answered. Signing is included in your CloudTalk plan. Branded Caller ID is a paid add-on billed per outbound call.

No. STIR/SHAKEN is a North American framework, mandated by the FCC in the US and the CRTC in Canada. Other countries are pursuing their own approaches to caller ID authentication, and many have none at all yet.

This matters more than it sounds if you sell into the US from elsewhere. Calls originating outside North America typically enter the US network through a gateway provider, which means gateway attestation (C), which means a higher chance of being labeled before anyone picks up. Using a local US number from a provider that signs your traffic at origin avoids that path entirely.

Signing happens automatically on outbound calls to US destinations. There is no setting to enable, no certificate to manage, and no separate authentication vendor to contract with. STIR/SHAKEN implementation is handled on the carrier side of the platform, which is where the regulatory obligation actually sits.

Around it sits the rest of the deliverability toolkit: anti-spam number registration, spam remediation for numbers that have picked up a bad reputation, Branded Caller ID for display, and local numbers in 160+ countries so your calls originate close to the people receiving them. Delivery is rarely fixed by one lever, and signing is the one that has to be in place before the others matter.