numbering identity · published

Troubleshooting STIR/SHAKEN attestation levels on outbound calls

Verified 2026-10-02 · 58 sources · tier 1–5

In the SHAKEN PASSporT, the 'attest' claim takes one of the values A, B or C, which correspond to Full Attestation, Partial Attestation and Gateway Attestation 35. The FCC's 2020 STIR/SHAKEN order ties these levels to two questions: whether the originating provider can confirm the identity of the subscriber, and whether it can confirm the telephone number the subscriber is using 171819.

How attestation levels are defined

RFC 8588 does not define what the A, B and C attestation levels mean; it points to ATIS-1000074 for those definitions 34.

The FCC's 2020 order gives these descriptions: 171819

Full (A) attestation: the originating provider can confirm the identity of the subscriber making the call, and that the subscriber is using its associated telephone number 17.
Partial (B) attestation: the provider can confirm the identity of the subscriber but not the telephone number 18.
Gateway (C) attestation: the provider is the point of entry to the IP network for a call that originated elsewhere, such as abroad or on a domestic network that is not STIR/SHAKEN-enabled 19.

The FCC states that A-level and B-level attestation both require confirming a direct authenticated relationship with the customer 42. It also states that a third party with no relationship to that customer cannot determine that relationship 42.

The FCC states that confirming a customer's legitimate right to use a telephone number for A attestation requires due diligence by the originating service provider 43.

Regulatory obligations behind signing

47 CFR 64.6301(a) required voice service providers to fully implement the STIR/SHAKEN authentication framework in the IP portions of their networks by June 30, 2021 11.

Under 47 CFR 64.6301(a), a voice service provider must obtain an SPC token from the Secure Telephone Identity Policy Administrator and use it to obtain its STIR/SHAKEN certificate 13.

The same rule requires a voice service provider to verify the caller identification information of calls it receives and will terminate 14.

47 CFR 64.6300(d) defines a gateway provider as a US-based intermediate provider that receives a call directly from a foreign originating provider and transmits it downstream to another US-based provider 12.

Third-party signing and delegation

The FCC's third-party authentication rules took effect on September 18, 2025 44. These rules are the Eighth Report and Order, FCC 24-120, adopted November 21, 2024 44.

A provider that uses a third-party authentication service must require the third party to sign calls with the certificate the provider itself obtained, not the third party's certificate 16. The FCC requires signing with the obligated provider's own certificate so that the Commission, other providers and analytics providers can identify which provider authenticated a call 40.

When a third party performs the signing, the provider with the implementation obligation must keep all attestation-level decisions for itself 15. That provider must also document the arrangement in writing 15.

The third-party order lets providers continue to use delegate certificates where the ATIS standards allow it 41. The provider stays responsible for vetting its customers 41.

In the 2020 order, the FCC recorded commenters' concern about enterprises that place calls through a voice provider other than the one controlling their numbers 20. Commenters said the standards did not account well for these enterprises, which made full attestation difficult 20. The FCC declined to delay the mandate and pointed to certificate delegation work in the standards bodies 20.

RFC 9060 delegate certificates let a certificate holder hand authority over a subset of its telephone numbers to another party 38. RFC 9060 gives the example of an enterprise sending calls through several carriers, which can then sign calls instead of sending them unauthenticated 38. Under RFC 9060, each delegate certificate's TNAuthList scope must equal or be a subset of its parent certificate's scope 39.

Platform differences

Amazon Connect

Amazon Connect signs outbound calls with STIR/SHAKEN when they originate from US DID or toll-free numbers to NANP destinations 7.

Amazon Connect gives A-level attestation when two conditions are both met 1:

The customer is under the AWS Service Terms, or buys through an authorised AWS Solution Provider or Distribution Seller. 1
The calling number was claimed in or ported into Amazon Connect. 1

Amazon Connect signs calls at B level when it has told the customer that more information is needed to keep A level, and has not yet confirmed that the information was validated 2.

Amazon Connect gives C level to any call that does not qualify for A or B 3. Examples include 3:

Calls through unauthorised solution providers. 3
Calls that violate the AWS Service Terms, such as call deflection. 3
Calls from accounts that missed a deadline to send requested attestation documents. 3

To keep the highest attestation, Amazon Connect may email the customer asking for more information by a stated date 5. Delays in replying may lower the calls' attestation level 5.

Twilio

Twilio signs at A only when three conditions are met: there is an approved Business Profile, an approved SHAKEN/STIR Trust Product is linked to it, and the calling number is assigned to both 45. Only calls from those assigned numbers are signed A 45.

Twilio signs at B when the account has an approved Primary Business Profile and an approved SHAKEN/STIR Trust Product linked to the parent account 46. B-level signing needs no phone-number assignment 46.

For caller IDs that are not Twilio phone numbers, B is the highest attestation Twilio can give, because it cannot attest to a customer's right to use a number it does not host 49.

Twilio signs at C when the account has no approved Business Profile and SHAKEN/STIR Trust Product, or when those were rejected 47.

Twilio Compliance Operations vets a Business Profile in about 24 hours and a SHAKEN/STIR Trust Product in about 72 hours 52.

Twilio states that its SHAKEN/STIR support is currently deployed only in the United States and France 50.

Genesys Cloud Voice

Genesys Cloud Voice signs all outbound SIP calls directly 29. Calls from Genesys Cloud Voice numbers receive full (A) attestation 29.

Genesys says calls made through Genesys Cloud Voice with BYOC (third-party) numbers receive partial (B) attestation 27. Genesys gives the reason that it can authenticate the customer but cannot verify ownership of the number 27.

Genesys tells BYOC customers to ask their carrier how their calls will be signed 28.

Webex Calling (inbound display)

Webex Calling maps the verstat value and attestation level of an incoming call to what the user sees: 58545556

'Verified Caller': the verstat is TN-Validation-Passed with A attestation 58.
'Possible Spam': the call passed validation with B or C attestation 54.
'Potential Fraud': the verstat is TN-Validation-Failed 55.
'Possible Spam': the verstat is No-TN-Validation, or the call has no verstat at all 56.

Webex Calling administrators can turn on two settings 53:

'Block calls that failed Caller ID validation' 53
'Present calls from unverified callers as normal calls' 53

These call indication features and caller ID validation settings apply only to Webex Calling locations in the United States and Canada 57.

Forwarded calls

RFC 8946 defines a 'div' PASSporT that explicitly indicates a call has been retargeted (diverted) from the original called number 37. The 'div' PASSporT is created by an authentication service at the retargeting entity 37.

In a 'div' PASSporT, the original called-party identifier from the 'dest' object becomes the 'div' claim 36. The original PASSporT and the 'div' PASSporT travel in separate Identity header fields 36.

Twilio has its own requirement for forwarding an inbound call while presenting the original caller ID 48. To keep SHAKEN/STIR verification in that case, pass the inbound webhook's CallToken value as the CallToken parameter when creating the new Call 48.

Twilio's StirVerstat parameter on inbound calls reports passed or failed validation together with the attestation level 51. It includes Diverted and Passthrough variants for forwarded calls 51.

WarmTransfer's reading of the sources is that a forwarded call presenting the original caller's number is usually signed at B or lower by the forwarding provider, because that number is not one the forwarding provider assigned 31. WarmTransfer's reading of the sources is also that keeping the original signature needs a mechanism such as RFC 8946 'div' or a vendor passthrough like Twilio's CallToken 31.

Diagnosing a low attestation level

Identify the provider that originates the call into the PSTN. We infer that on BYOC trunks, the attestation a called party sees is set by whichever provider originates the call into the PSTN, usually the BYOC carrier 30. We infer that raising the attestation is then a request to that carrier, backed by proof of number ownership 30.
Check whether the signing provider hosts the calling number. Twilio caps attestation at B for caller IDs that are not Twilio phone numbers 49. Genesys gives B to calls with BYOC numbers 27. Amazon Connect requires that the calling number was claimed in or ported into Amazon Connect for A level 1.
Check vetting and document status. On Twilio, A level needs the calling number assigned to an approved Business Profile and to an approved SHAKEN/STIR Trust Product 45. Rejected or missing approvals result in C 47. On Amazon Connect, an unanswered request for information can lower attestation 5. A missed document deadline results in C 3.
Check whether the call was forwarded. Twilio requires the CallToken parameter to keep SHAKEN/STIR verification on forwarded calls that present the original caller ID 48.
Allow for loss in transit. Amazon warns that Connect's attestation may not be preserved end to end, because legacy equipment in some carrier networks cannot carry the STIR/SHAKEN headers 6.
Review ported numbers. Field reports suggest that Teams Calling Plan users have seen outbound calls from numbers ported from another carrier shown as 'Potential Spam' by a US mobile carrier 26. In those reports, moderators advise asking that carrier to review the range and opening a Microsoft ticket to check STIR/SHAKEN handling of the ported numbers 26.

Blocking, labelling and redress

Amazon notes that carriers might use attestation levels when deciding whether to deliver calls on their networks 4.

A terminating provider that blocks a call under 47 CFR 64.1200 must immediately return a response that identifies the block 9:

On IP networks, a SIP 603 response, or a response from the 607/608 family. 9
On non-IP networks, ISUP cause code 21. 9

A terminating provider that blocks calls under 47 CFR 64.1200 must publish a single point of contact on its public website for receiving complaints about call-blocking errors 8.

On a subscriber's request, a terminating provider must provide a list of calls to that number it blocked in the previous 28 days 10. The list must be provided free of charge within 3 business days 10.

The Free Caller Registry is run jointly by 3 call-protection (analytics) providers: First Orion, Hiya and TNS 24.

The registry asks the registrant to confirm that it is the business that uses the numbers, not a service provider registering for someone else 21. It accepts up to 20 US 10-digit numbers per submission 21.

The Free Caller Registry terms state that registering numbers does not guarantee redress, because each call-protection provider analyses calls independently 22.

We infer that registering with the Free Caller Registry is a voluntary submission to analytics vendors, not a filing in the FCC Robocall Mitigation Database 23. We infer that registering also does not change a call's STIR/SHAKEN attestation 23.

In the field, community answers sometimes present the Free Caller Registry as the FCC Robocall Mitigation Database, which conflates an analytics-vendor registry with a regulatory provider filing 25.

Applicability

Applies to: Amazon Web Services Amazon Connect, Twilio Trust Hub, Twilio Programmable Voice, Genesys Cloud, Cisco Webex Calling, Microsoft Teams Phone, and Free Caller Registry. Deployments: multi-tenant and carrier. Sources checked 2026-10-02. Amazon Connect signs only calls from US DID or toll-free numbers to NANP destinations 7.

Twilio's SHAKEN/STIR support is stated as deployed only in the United States and France 50.

Webex Calling's call indication and caller ID validation settings apply only to locations in the United States and Canada 57.

The FCC's third-party authentication rules took effect on September 18, 2025 44.

The deployment model is not covered by the sources below.

What remains uncertain

Microsoft Teams Calling Plan and Operator Connect attestation behaviour is not covered by the sources below.
FCC call labelling and redress proceedings for analytics spam labels are not covered by the sources below.
The KYUP FNPRM proposals affecting STIR/SHAKEN are not covered by the sources below.
Rich Call Data and branded calling as a remedy for spam labels are not covered by the sources below.
Webex Calling outbound signing per PSTN option (Cisco Calling Plan, CCPP or Local Gateway) is not covered by the sources below.
CRTC rules for STIR/SHAKEN attestation in Canada are not covered by the sources below.
The general rules for toll-free number attestation and the RespOrg's role are not covered by the sources below.
ATIS-1000092 delegate certificate practice for enterprises is not covered by the sources below.
The text of the ATIS-1000074 attestation definitions is not covered by the sources below.

Sources

1
Amazon Connect gives A-level attestation when the customer is under the AWS Service Terms or buys through an authorised AWS Solution Provider or Distribution Seller, and the calling number was claimed in or ported into Amazon Connect.
Stir/Shaken attestation in Connect Customer · Requirements for A-level attestation · Checked 2026-10-02
2
Amazon Connect signs calls at B level when it has told the customer that more information is needed to keep A level and has not yet confirmed that the information was validated.
Stir/Shaken attestation in Connect Customer · Requirements for B-level attestation · Checked 2026-10-02
3
Amazon Connect gives C level to any call that does not qualify for A or B, including calls through unauthorised solution providers, calls that violate the AWS Service Terms (such as call deflection), and accounts that missed a deadline to send requested attestation documents.
Stir/Shaken attestation in Connect Customer · Examples of calls that receive C-level attestation · Checked 2026-10-02
4
Amazon notes that carriers might use attestation levels when deciding whether to deliver calls on their networks.
Stir/Shaken attestation in Connect Customer · Important things to know · Checked 2026-10-02
5
To keep the highest attestation, Amazon Connect may email the customer asking for more information by a stated date, and delays in replying may lower the calls' attestation level.
Stir/Shaken attestation in Connect Customer · Important things to know · Checked 2026-10-02
6
Amazon warns that Connect's attestation may not be preserved end to end, because legacy equipment in some carrier networks cannot carry the STIR/SHAKEN headers.
Stir/Shaken attestation in Connect Customer · Important things to know · Checked 2026-10-02
7
Amazon Connect signs outbound calls with STIR/SHAKEN when they originate from US DID or toll-free numbers to NANP (+1) destinations.
Stir/Shaken attestation in Connect Customer · page introduction · Checked 2026-10-02
8
A terminating provider that blocks calls under 47 CFR 64.1200 must publish a single point of contact on its public website for receiving complaints about call-blocking errors.
47 CFR § 64.1200 - Delivery restrictions · 47 CFR 64.1200(k)(8) · Checked 2026-10-02
9
A terminating provider that blocks a call under 47 CFR 64.1200 must immediately return a SIP 603 (or 607/608 family) response on IP networks, or ISUP cause code 21 on non-IP networks.
47 CFR § 64.1200 - Delivery restrictions · 47 CFR 64.1200(k)(9) · Checked 2026-10-02
10
On a subscriber's request, a terminating provider must provide free of charge, within 3 business days, a list of calls to that number it blocked in the previous 28 days.
47 CFR § 64.1200 - Delivery restrictions · 47 CFR 64.1200(k)(10) · Checked 2026-10-02
11
47 CFR 64.6301(a) required voice service providers to fully implement the STIR/SHAKEN authentication framework in the IP portions of their networks by June 30, 2021.
47 CFR § 64.6301 - Caller ID authentication · 47 CFR 64.6301(a) · Checked 2026-10-02
12
47 CFR 64.6300(d) defines a gateway provider as a US-based intermediate provider that receives a call directly from a foreign originating provider and transmits it downstream to another US-based provider.
47 CFR § 64.6300 - Definitions · 47 CFR 64.6300(d) · Checked 2026-10-02
13
Under 47 CFR 64.6301(a) a voice service provider must obtain an SPC token from the Secure Telephone Identity Policy Administrator and use it to obtain its STIR/SHAKEN certificate.
47 CFR § 64.6301 - Caller ID authentication · 47 CFR 64.6301(a) · Checked 2026-10-02
14
47 CFR 64.6301(a) requires a voice service provider to verify the caller identification information of calls it receives and will terminate.
47 CFR § 64.6301 - Caller ID authentication · 47 CFR 64.6301(a) · Checked 2026-10-02
15
When a third party performs STIR/SHAKEN signing, the provider with the implementation obligation must keep all attestation-level decisions for itself and document the arrangement in writing.
47 CFR § 64.6301 - Caller ID authentication · 47 CFR 64.6301(b) · Checked 2026-10-02
16
A provider that uses a third-party authentication service must require the third party to sign calls with the certificate the provider itself obtained, not the third party's certificate.
47 CFR § 64.6301 - Caller ID authentication · 47 CFR 64.6301(b) · Checked 2026-10-02
17
The FCC's 2020 STIR/SHAKEN order describes full (A) attestation as the originating provider being able to confirm the identity of the subscriber making the call and that the subscriber is using its associated telephone number.
Call Authentication Trust Anchor; Implementation of TRACED Act Section 6(a)—Knowledge of Customers by Entities With Access to Numbering Resources (85 FR 22029) · paragraph 8, 85 FR 22031 · Checked 2026-10-02
18
The FCC's 2020 STIR/SHAKEN order describes partial (B) attestation as the provider being able to confirm the identity of the subscriber but not the telephone number.
Call Authentication Trust Anchor; Implementation of TRACED Act Section 6(a)—Knowledge of Customers by Entities With Access to Numbering Resources (85 FR 22029) · paragraph 8, 85 FR 22031 · Checked 2026-10-02
19
The FCC's 2020 STIR/SHAKEN order describes gateway (C) attestation as the provider being the point of entry to the IP network for a call that originated elsewhere, such as abroad or on a domestic network that is not STIR/SHAKEN-enabled.
Call Authentication Trust Anchor; Implementation of TRACED Act Section 6(a)—Knowledge of Customers by Entities With Access to Numbering Resources (85 FR 22029) · paragraph 8, 85 FR 22031 · Checked 2026-10-02
20
In the 2020 order the FCC recorded commenters' concern that the standards did not account well for enterprises placing calls through a voice provider other than the one controlling their numbers, making full attestation difficult; it declined to delay the mandate and pointed to certificate delegation work in the standards bodies.
Call Authentication Trust Anchor; Implementation of TRACED Act Section 6(a)—Knowledge of Customers by Entities With Access to Numbering Resources (85 FR 22029) · paragraph 29, 85 FR 22034 · Checked 2026-10-02
21
The Free Caller Registry asks the registrant to confirm it is the business that uses the numbers, not a service provider registering for someone else, and accepts up to 20 US 10-digit numbers per submission.
Free Caller Registry · registration form requirements · Checked 2026-10-02
22
The Free Caller Registry terms state that registering numbers does not guarantee redress, because each call-protection provider analyses calls independently.
Free Caller Registry · terms of registration · Checked 2026-10-02
23
Registering with the Free Caller Registry is a voluntary submission to analytics vendors; it is not filing in the FCC Robocall Mitigation Database and does not change a call's STIR/SHAKEN attestation.inferred
Free Caller Registry · registry home page (operators) read with 47 CFR 64.6301(b) · Checked 2026-10-02
24
The Free Caller Registry is run jointly by three call-protection (analytics) providers: First Orion, Hiya and TNS.
Free Caller Registry · registry home page · Checked 2026-10-02
25
Field pattern: community answers sometimes present the Free Caller Registry as the FCC Robocall Mitigation Database, which conflates an analytics-vendor registry with a regulatory provider filing.field report
Teams are being flagged as 'Potential Spam' by some carriers · moderator reply, item headed FCC Robocall Mitigation Database · Checked 2026-10-02
26
Field pattern: Teams Calling Plan users report outbound calls from numbers ported from another carrier being shown as 'Potential Spam' by a US mobile carrier; moderators advise asking that carrier to review the range and opening a Microsoft ticket to check STIR/SHAKEN handling of the ported numbers.field report
Teams are being flagged as 'Potential Spam' by some carriers · question and moderator replies, September 2025 · Checked 2026-10-02
27
Genesys says calls made through Genesys Cloud Voice with BYOC (third-party) numbers receive partial (B) attestation, because it can authenticate the customer but cannot verify ownership of the number.
Genesys Cloud Voice support of the STIR/SHAKEN mandate · attestation levels section · Checked 2026-10-02
28
Genesys tells BYOC customers to ask their carrier how their calls will be signed.
Genesys Cloud Voice support of the STIR/SHAKEN mandate · BYOC section · Checked 2026-10-02
29
Genesys Cloud Voice signs all outbound SIP calls directly, and calls from Genesys Cloud Voice numbers receive full (A) attestation.
Genesys Cloud Voice support of the STIR/SHAKEN mandate · outbound call signing section · Checked 2026-10-02
30
On BYOC trunks the attestation a called party sees is set by whichever provider originates the call into the PSTN, usually the BYOC carrier, so raising the attestation is a request to that carrier, backed by proof of number ownership.inferred
Genesys Cloud Voice support of the STIR/SHAKEN mandate · BYOC section, read with 47 CFR 64.6301(b) and 90 FR 40245 · Checked 2026-10-02
31
A forwarded call that presents the original caller's number is usually signed at B or lower by the forwarding provider, because that number is not one the forwarding provider assigned; keeping the original signature needs a mechanism such as RFC 8946 'div' or a vendor passthrough like Twilio's CallToken.inferred
SHAKEN/STIR Onboarding · Level B attestation requirements, read with RFC 8946 section 3 · Checked 2026-10-02
32
The 64.1200(k) redress obligations are written for call blocking, so a call delivered with a 'spam' label is probably not covered by those dispute and notification duties.inferred
47 CFR § 64.1200 - Delivery restrictions · 47 CFR 64.1200(k)(8)-(k)(11) · Checked 2026-10-02
33
None of the FCC texts reviewed requires an originating provider to give any particular call A attestation; they govern who decides attestation and what A and B require, so a customer cannot demand A as a regulatory right.inferred
Call Authentication Trust Anchor (Federal Register 2025-15809; FCC 24-120) · 90 FR 40244-40245 · Checked 2026-10-02
34
RFC 8588 does not define the meaning of the A, B and C attestation levels itself; it points to ATIS-1000074 for those definitions.
RFC 8588: Personal Assertion Token (PaSSporT) Extension for Signature-based Handling of Asserted information using toKENs (SHAKEN) · RFC 8588 section 4 · Checked 2026-10-02
35
In the SHAKEN PASSporT the 'attest' claim takes one of the values A, B or C, which correspond to Full Attestation, Partial Attestation and Gateway Attestation.
RFC 8588: Personal Assertion Token (PaSSporT) Extension for Signature-based Handling of Asserted information using toKENs (SHAKEN) · RFC 8588 section 4 · Checked 2026-10-02
36
In a 'div' PASSporT the original called-party identifier from the 'dest' object becomes the 'div' claim, and the original and div PASSporTs travel in separate Identity header fields.
RFC 8946: Personal Assertion Token (PASSporT) Extension for Diverted Calls · RFC 8946 section 3 · Checked 2026-10-02
37
RFC 8946 defines a 'div' PASSporT that explicitly indicates a call has been retargeted (diverted) from the original called number, created by an authentication service at the retargeting entity.
RFC 8946: Personal Assertion Token (PASSporT) Extension for Diverted Calls · RFC 8946 sections 1 and 3 · Checked 2026-10-02
38
RFC 9060 delegate certificates let a certificate holder hand authority over a subset of its telephone numbers to another party, for example an enterprise sending calls through several carriers, so that party can sign calls instead of sending them unauthenticated.
RFC 9060: Secure Telephone Identity Revisited (STIR) Certificate Delegation · RFC 9060 section 1 · Checked 2026-10-02
39
Under RFC 9060 each delegate certificate's TNAuthList scope must equal or be a subset of its parent certificate's scope.
RFC 9060: Secure Telephone Identity Revisited (STIR) Certificate Delegation · RFC 9060 section 4 · Checked 2026-10-02
40
The FCC requires signing with the obligated provider's own certificate so that the Commission, other providers and analytics providers can identify which provider authenticated a call.
Call Authentication Trust Anchor (Federal Register 2025-15809; FCC 24-120) · 90 FR 40244-40245 · Checked 2026-10-02
41
The FCC's third-party order lets providers continue to use delegate certificates where the ATIS standards allow it, but the provider stays responsible for vetting its customers.
Call Authentication Trust Anchor (Federal Register 2025-15809; FCC 24-120) · 90 FR 40245 · Checked 2026-10-02
42
The FCC states that A- and B-level attestation both require confirming a direct authenticated relationship with the customer, which a third party with no relationship to that customer cannot determine.
Call Authentication Trust Anchor (Federal Register 2025-15809; FCC 24-120) · 90 FR 40245 · Checked 2026-10-02
43
The FCC states that confirming a customer's legitimate right to use a telephone number for A attestation requires due diligence by the originating service provider.
Call Authentication Trust Anchor (Federal Register 2025-15809; FCC 24-120) · 90 FR 40245 · Checked 2026-10-02
44
The FCC's third-party authentication rules (the Eighth Report and Order, FCC 24-120, adopted November 21, 2024) took effect on September 18, 2025.
Call Authentication Trust Anchor (Federal Register 2025-15809; FCC 24-120) · DATES; preamble · Checked 2026-10-02
45
Twilio signs at A only when there is an approved Business Profile, an approved SHAKEN/STIR Trust Product linked to it, and the calling number is assigned to both; only calls from those assigned numbers are signed A.
SHAKEN/STIR Onboarding · Level A attestation requirements · Checked 2026-10-02
46
Twilio signs at B when the account has an approved Primary Business Profile and an approved SHAKEN/STIR Trust Product linked to the parent account, with no phone-number assignment needed.
SHAKEN/STIR Onboarding · Level B attestation requirements · Checked 2026-10-02
47
Twilio signs at C when the account has no approved Business Profile and SHAKEN/STIR Trust Product, or when those were rejected.
SHAKEN/STIR Onboarding · Level C attestation · Checked 2026-10-02
48
To keep SHAKEN/STIR verification when forwarding an inbound call while presenting the original caller ID, Twilio requires passing the inbound webhook's CallToken value as the CallToken parameter when creating the new Call.
Trusted Calling with SHAKEN/STIR · call forwarding / CallToken section · Checked 2026-10-02
49
For caller IDs that are not Twilio phone numbers, B is the highest attestation Twilio can give, because it cannot attest to a customer's right to use a number it does not host.
SHAKEN/STIR Onboarding · Level B attestation requirements · Checked 2026-10-02
50
Twilio states that its SHAKEN/STIR support is currently deployed only in the United States and France.
Trusted Calling with SHAKEN/STIR · geographic scope statement · Checked 2026-10-02
51
Twilio's StirVerstat parameter on inbound calls reports passed or failed validation with the attestation level, and includes Diverted and Passthrough variants for forwarded calls.
Trusted Calling with SHAKEN/STIR · StirVerstat parameter table · Checked 2026-10-02
52
Twilio Compliance Operations vets a Business Profile in about 24 hours and a SHAKEN/STIR Trust Product in about 72 hours.
SHAKEN/STIR Onboarding · Vetting section · Checked 2026-10-02
53
Webex Calling administrators can turn on 'Block calls that failed Caller ID validation' and 'Present calls from unverified callers as normal calls'.
Secure Calling and Spam mitigation · Control Hub settings section · Checked 2026-10-02
54
Webex Calling shows an incoming call that passed validation with B or C attestation as 'Possible Spam'.
Secure Calling and Spam mitigation · Verstat value and attestation table · Checked 2026-10-02
55
Webex Calling shows an incoming call whose verstat is TN-Validation-Failed as 'Potential Fraud'.
Secure Calling and Spam mitigation · Verstat value and attestation table · Checked 2026-10-02
56
Webex Calling shows an incoming call with No-TN-Validation, or with no verstat at all, as 'Possible Spam'.
Secure Calling and Spam mitigation · Verstat value and attestation table · Checked 2026-10-02
57
Webex Calling's call indication features and caller ID validation settings apply only to Webex Calling locations in the United States and Canada.
Secure Calling and Spam mitigation · Provision user notification using Control Hub · Checked 2026-10-02
58
Webex Calling shows an incoming call as 'Verified Caller' when the verstat is TN-Validation-Passed with A attestation.
Secure Calling and Spam mitigation · Verstat value and attestation table · Checked 2026-10-02

Documents

tier 1 standards and regulators

Call Authentication Trust Anchor; Implementation of TRACED Act Section 6(a)—Knowledge of Customers by Entities With Access to Numbering Resources (85 FR 22029)

Federal Communications Commission via Office of the Federal Register (GovInfo) · 2020-04-21 · accessed 2026-10-02

tier 1 standards and regulators

RFC 8588: Personal Assertion Token (PaSSporT) Extension for Signature-based Handling of Asserted information using toKENs (SHAKEN)

IETF / RFC Editor · 2019-05-01 · accessed 2026-09-25

tier 1 standards and regulators

Cite this page

APA

WarmTransfer. (2026, October 2). Troubleshooting STIR/SHAKEN attestation levels on outbound calls. WarmTransfer. https://warmtransfer.net/knowledge/stir-shaken-attestation-troubleshooting

BibTeX

@misc{warmtransfer-stir-shaken-attestation-troubleshooting,
  title  = {Troubleshooting STIR/SHAKEN attestation levels on outbound calls},
  author = {{WarmTransfer}},
  year   = {2026},
  url    = {https://warmtransfer.net/knowledge/stir-shaken-attestation-troubleshooting},
  note   = {Verified 2026-10-02}
}

Troubleshooting STIR/SHAKEN attestation levels on outbound calls

How attestation levels are defined

Regulatory obligations behind signing

Third-party signing and delegation

Platform differences

Amazon Connect

Twilio

Genesys Cloud Voice

Webex Calling (inbound display)

Forwarded calls

Diagnosing a low attestation level

Blocking, labelling and redress

See also

Applicability

What remains uncertain

See also

Depends on

Related to

Referenced by

Sources

Documents

47 CFR § 64.1200 - Delivery restrictions

47 CFR § 64.6300 - Definitions

47 CFR § 64.6301 - Caller ID authentication

Call Authentication Trust Anchor (Federal Register 2025-15809; FCC 24-120)

Call Authentication Trust Anchor; Implementation of TRACED Act Section 6(a)—Knowledge of Customers by Entities With Access to Numbering Resources (85 FR 22029)

RFC 8588: Personal Assertion Token (PaSSporT) Extension for Signature-based Handling of Asserted information using toKENs (SHAKEN)

RFC 8946: Personal Assertion Token (PASSporT) Extension for Diverted Calls

RFC 9060: Secure Telephone Identity Revisited (STIR) Certificate Delegation

Free Caller Registry

Genesys Cloud Voice support of the STIR/SHAKEN mandate

Secure Calling and Spam mitigation

SHAKEN/STIR Onboarding

Stir/Shaken attestation in Connect Customer

Trusted Calling with SHAKEN/STIR

Teams are being flagged as 'Potential Spam' by some carriers

Cite this page