What is STIR/SHAKEN?
STIR/SHAKEN supports caller-ID authentication across participating telephone networks. It helps a receiving provider evaluate the identity asserted by the originating provider. It does not verify the caller’s intentions or guarantee a spam-free call.
Definition
Caller-ID text alone can be spoofed. STIR adds a signed identity assertion to SIP requests so a receiving service can validate the assertion using the signer’s credentials.
The signature travels in the SIP Identityheader as a JSON Web Token (JWT). The header includes the calling number, called number, timestamp, and a reference to the originating carrier's certificate. Receiving carriers fetch the cert and verify the signature in real time.
Attestation levels
On supported routes, a carrier’s attestation describes its relationship to the caller and calling number:
| Level | Meaning |
|---|---|
A (Full) | Carrier knows the caller and the caller has a verified right to use the number. |
B (Partial) | Carrier knows the caller but cannot verify the right to use the number. |
C (Gateway) | Carrier received the call from another network and is just passing it on. |
Call labeling is decided by receiving providers and their analytics. An attestation is one signal; it does not guarantee delivery, a verification badge or exemption from spam labeling.
Using Message.com numbers
Use a number assigned to your workspace and an authorized caller ID. The carrier and route determine authentication and labeling. Message.com does not promise that every outbound call receives full attestation or that every inbound call includes a verification result.
For a delivery or labeling problem, retain the call ID, time and destination for support. The Calls API documents the call fields available to integrations. Do not rely on undocumented attestation fields or use caller ID alone to authorize access to a customer account.
What STIR/SHAKEN does not do
STIR/SHAKEN authenticates the calling number, not the content of the call. A robocaller with a legitimate signed number can still be a robocaller. Carriers layer analytics on top (call patterns, complaint volume, voice fingerprinting) to detect bad behavior independent of authentication. See robocall mitigation.
External reading
For the protocol details, see RFC 8224 on authenticated identity management in SIP.