What is STIR/SHAKEN?
STIR/SHAKEN is the caller-ID authentication framework that VOIP carriers in the United States and Canada must implement under FCC and CRTC rules. STIR (Secure Telephony Identity Revisited) is the cryptographic standard. SHAKEN (Signature-based Handling of Asserted Information Using toKENs) is the carrier-deployment profile of STIR.
Definition
Before STIR/SHAKEN, any VOIP carrier could put any caller ID on any outbound call. Robocallers exploited this by spoofing local numbers ("neighbor spoofing") so victims would pick up. STIR/SHAKEN solves the trust problem by having the originating carrier cryptographically sign the calling number, and having terminating carriers verify the signature.
The signature travels in the SIP Identityheader as a JSON Web Token (JWT). The header includes the calling number, called number, timestamp, and a reference to the originating carrier's certificate. Receiving carriers fetch the cert and verify the signature in real time.
Attestation levels
Originating carriers assign one of three attestation levels to every outbound call:
| Level | Meaning |
|---|---|
A (Full) | Carrier knows the caller and the caller has a verified right to use the number. |
B (Partial) | Carrier knows the caller but cannot verify the right to use the number. |
C (Gateway) | Carrier received the call from another network and is just passing it on. |
Calls with attestation A are most likely to pass through verifying carriers without being labeled "Spam Likely". Carriers and downstream apps use the attestation level (combined with their own signals) to display a verification badge or a warning.
Where message.com sits
Phone numbers in message.com run on our own carrier-grade telephony infrastructure, which signs outbound calls with attestation A. Inbound calls arrive with the originating carrier's signature; message.com surfaces the attestation level and the verification result on each call event in the Calls API.
Customers do not have to do anything to participate in STIR/SHAKEN. The certificate management happens entirely between carriers. The benefit you see is reduced call labeling: outbound calls from your message.com DIDs are signed with full attestation and therefore less likely to be flagged as spam by terminating carriers.
What STIR/SHAKEN does not do
STIR/SHAKEN authenticates the calling number, not the content of the call. A robocaller with a legitimate signed number can still be a robocaller. Carriers layer analytics on top (call patterns, complaint volume, voice fingerprinting) to detect bad behavior independent of authentication. See robocall mitigation.
External reading
For the protocol details, see RFC 8224 on authenticated identity management in SIP.