STIR/SHAKEN and Attestation, Explained
How calls get cryptographically signed and verified, what's inside the SHAKEN PASSporT, and what the A/B/C attestation grades actually mean — including why a brand can never assign its own.
STIR/SHAKEN is the caller-ID authentication framework that lets a destination carrier confirm a call’s number wasn’t spoofed. STIR (Secure Telephone Identity Revisited) is the set of IETF cryptographic standards; SHAKEN is the ATIS/SIP profile that carriers actually deploy on their networks. Together they sign each call at origination and verify it at termination.
It is the foundation of voice trust — but on its own it does not stop a “Spam Likely” label. That is the job of the analytics layer. STIR/SHAKEN answers a narrower question: is this caller authorized to use this number?
How signing and verification work
The flow has two services on opposite ends of the call:
- Authentication (originating side). The originating provider’s authentication service creates a signed SIP Identity header containing a SHAKEN PASSporT . It signs with a private key tied to a certificate the provider obtained through the SHAKEN governance/certificate authority chain.
- Verification (terminating side). The terminating provider’s verification service pulls the certificate (via the
x5uURL in the token), validates the signature against the certificate chain, and confirms the calling number wasn’t tampered with.
If the signature validates, the terminating carrier trusts that the originating provider vouched for the call at the attestation level it stamped.
Inside the PASSporT
The PASSporT (Personal Assertion Token) is a JWT. Its key fields:
| Part | Field | Meaning |
|---|---|---|
| Header | alg=ES256 | Signing algorithm (ECDSA P-256) |
| Header | ppt=shaken | PASSporT type extension — SHAKEN profile |
| Header | typ=passport | Token type |
| Header | x5u= | URL of the signing certificate |
| Payload | attest | The attestation grade — A, B, or C |
| Payload | orig | The calling number |
| Payload | dest | The called number |
| Payload | iat | Issued-at timestamp |
| Payload | origid | An opaque origination identifier (traceback) |
Branded calling extends this same token with extra fields (nam, crn, icn) — see branded calling (BCID/RCD).
The attestation grades
The originating provider assigns one of three grades to every call it signs. The grade reflects how confident the provider is that the caller is entitled to the number.
| Level | Meaning | Answer-rate risk |
|---|---|---|
| A · Full | Provider authenticated the customer AND confirmed they're authorized to use the calling number (its own registered subscriber/DID). | Lowest — best answer rates |
| B · Partial | Provider authenticated the customer but cannot verify they own the specific number (e.g. enterprise PBX / BYOC trunk). | Medium |
| C · Gateway | Provider only authenticated where it received the call, not the source (e.g. an international gateway). | High — effectively a red flag |
In plain terms:
- A (Full) — the provider authenticated the customer and confirmed they’re authorized to use the calling number (it’s the provider’s own registered subscriber/DID). Best answer rates.
- B (Partial) — the provider authenticated the customer but cannot verify they own the specific number, e.g. an enterprise PBX or a BYOC trunk.
- C (Gateway) — the provider only authenticated where it received the call, not the source — typically an international or interconnect gateway. Effectively a red flag.
The FCC mandate and the RMD
STIR/SHAKEN is FCC-mandated on IP networks. Providers that can’t fully implement it must instead file a robocall mitigation plan. Either way, every voice, intermediate, and gateway provider must be filed in the Robocall Mitigation Database .
| Provider type | STIR/SHAKEN deadline |
|---|---|
| Large voice providers | June 30, 2021 |
| Non-facilities-based small voice providers | June 30, 2022 |
| Facilities-based small voice providers | June 30, 2023 |
| Gateway providers (foreign-originated traffic) | Required to authenticate |
| Non-IP / TDM portions | Continuing extension while a non-IP equivalent is developed |
New third-party caller-ID authentication obligations took effect Sept 18, 2025, broadening who must sign. The RMD piece — including the annual recertification you depend on your provider to maintain — is covered in detail on the Robocall Mitigation Database page.
Why this matters to a brand
You don’t operate any of this machinery — your provider does. But the output (your attestation grade) directly drives whether your calls get a clean treatment or a spam treatment downstream. The practical takeaways:
- Choose a provider that will sign your traffic at A.
- Originate only from numbers that provider assigned or verified for you.
- Keep that provider in good RMD standing (it’s their obligation, but their failure blocks you).
Next: Get A-level attestation →