STIR/SHAKEN Attestation A, B and C Explained

The short answer

Every call your business places over an IP phone network in the US or Canada is supposed to carry a digital signature from the provider that put it on the network. Inside that signature is a single letter: A, B or C. It says how sure the provider is that the caller is allowed to use the number shown as caller ID.

• A (full attestation): the provider knows the customer and knows the customer has the right to use that number.
• B (partial attestation): the provider knows the customer but cannot confirm their right to the number displayed.
• C (gateway attestation): the provider is passing along a call it cannot vouch for, such as one arriving from an international route or an older network.

You do not choose the letter. Your provider does, under rules that make it the provider's decision. If your calls are rated B or C, the fix is almost always about which provider originates the call and which number it displays, not about your business itself.

This guide explains the levels, the common reasons small-business calls get a lower rating, what the US and Canadian rules say as of October 2026, and the questions to put to your phone provider. It is educational information, not legal advice.

What STIR/SHAKEN actually does

STIR/SHAKEN is a caller ID authentication framework. The FCC summarises it this way: calls on IP phone networks "can have their caller ID 'signed' as legitimate by originating carriers and validated by other carriers before reaching consumers" ^[1]. STIR is the IETF signing method, defined in RFC 8224 (February 2018). SHAKEN is the industry profile built on top of it, and RFC 8588 (May 2019) adds the "attest" claim that carries the A, B or C.

Two limits are worth knowing from the start:

1. It only works on IP networks. The FCC notes the framework "is only operational in IP networks," so providers still using older network technology must either upgrade or work on a non-IP solution ^[1][2]. A call that crosses an old segment can arrive with no signature at all.
2. A valid signature does not decide what happens to the call. RFC 8224 says verification "does not entail any particular treatment of the request," and that handling afterwards depends on "local policy" ^[3]. The FCC describes authentication as something that "helps supports providers' blocking decisions and call labeling efforts" ^[1], not as the label itself.

The three attestation levels

RFC 8588 defines the claim with three values, A, B and C, corresponding to "Full Attestation," "Partial Attestation" and "Gateway Attestation," and points to the industry standard ATIS-1000074 for the full definitions ^[4].

Sources: RFC 8588; Twilio Docs.

ATIS-1000074 spells out the conditions. For A, the signing provider originates the call, has a direct authenticated relationship with the customer and can identify it, and "has established a verified association with the telephone number used for the call." B meets the first two conditions but not the third. C is for a provider that "has no relationship with the originator of the call (e.g., international gateways)", or that lacks the information to give A or B. What proves a customer's right to a number is left to provider policy; the standard's examples include a number the provider assigned to that customer and a number from another provider that the customer is authorized to use ^[5].

The key idea in A is the number-to-customer link: the provider knows who you are and knows the number is yours to use. B means one of those two pieces is missing (usually the second). C means the provider is only vouching that the call passed through it.

Who decides your rating: the provider, by rule

In the US, 47 CFR 64.6301 required voice service providers to fully implement STIR/SHAKEN in their IP networks by June 30, 2021, authenticating caller ID on the SIP calls they originate and verifying it on the calls they terminate ^[6].

A provider may hire a third party to do the technical signing, but under the current rule it must still make "all attestation-level decisions" for the calls it originates, and every call must be signed with the provider's own certificate ^[6]. Those third-party conditions come from the FCC's order FCC 24-120, published in the Federal Register on August 19, 2025 and effective September 18, 2025 ^[7].

Further along the call path, gateway providers (US carriers that receive calls directly from foreign providers) must sign unauthenticated calls that show US numbers, and intermediate providers must pass existing signatures along unaltered except for technical or security reasons ^[8]). Separately, every provider, whether or not it has a STIR/SHAKEN obligation, must file in the FCC's Robocall Mitigation Database (^[1][9].

What this means for you: the rules bind providers, not their business customers. There is no form a business files with the FCC to "get A." What you can do is make it easy for your provider to know the number is yours.

Why a small business's calls land on B or C

No source publishes a universal rulebook for how each provider assigns levels; ATIS-1000074 sets the framework and each provider applies it. Carrier documentation shows the common patterns, though:

The most common small-business cause is the second row. A business keeps its main number with one company (say, the old landline carrier or a phone-menu service) and makes outbound calls through another (a VoIP app, a call-centre tool, an appointment-reminder platform), setting caller ID to the main number. The outbound provider knows the customer but did not issue the number, so B is the honest answer.

Attestation is not the same as a spam label

A call with attestation A can still show "Spam Likely," and a call with B can ring through with no warning. The labels come from analytics run by the terminating carrier or its partners under their own "local policy" ^[3]. Attestation is one input among many.

Nor does A guarantee a "Verified" mark or your business name on the screen. In December 2025 the FCC proposed requiring terminating providers to transmit verified caller name or other identity information "whenever they transmit an indication that a call has received an A-level attestation" ^[12]. That it is a proposal tells you it is not yet a requirement; display today depends on the receiving carrier and the handset.

If your real problem is the label, start with our guides on why a business number shows up as spam and what to do about "Spam Likely". For a deeper treatment of the standards, see our STIR/SHAKEN research brief.

How to move from B or C toward A: a checklist

These steps follow from how the levels are defined. The exact proof each provider accepts varies, so treat the provider's answer as the final word.

1. List every system that places calls showing your business number. Desk phones, softphone apps, mobile apps, dialers, reminder tools, answering services. Note which company carries each one's outbound calls.
2. Match number and provider. For each system, ask: did this provider issue the number, or port it in? If not, that system is a likely B.
3. Consolidate where you can. Make outbound calls through the provider that holds the number, or port the number to the provider you call out through. This is the most direct route to A, because that provider knows the number is yours.
4. Where a third-party tool must show your number, ask how it verifies your right to use it. Some providers have a process for confirming a customer's right to a number they don't host; ask what it is and what level results.
5. Stop displaying numbers you don't control. Showing a number you don't own (or a number belonging to a client) invites B at best.
6. Avoid sending domestic calls over international routes. Cheap routes that enter through a gateway tend to arrive as C.
7. Re-check after any change. A new phone app, a new reminder service or a port can change the level overnight.

Questions to send your provider

You can paste these into a support ticket:

• "When we place calls showing [number], what attestation level do you sign: A, B or C?"
• "Do you sign with your own STI certificate, or does a third party sign for you? If a third party signs, do you still make the attestation decision?" (Under 47 CFR 64.6301(b), the provider must.)
• "What do you need from us to confirm our right to use [number] if it is hosted with another provider?"
• "Are any of our calls routed over non-IP or international routes where the signature could be lost or downgraded?"
• "When you forward or transfer a call, do you keep the original signature?"
• "Is your company listed in the FCC Robocall Mitigation Database?"

Canada and the US side by side

Sources: 47 CFR 64.6301; 47 CFR 64.6303; CRTC 2021-123; CRTC 2025-343; FCC.

Cross-border calls use separate certificates. Telnyx, for example, signs Canada-to-Canada calls with its Canadian certificate and calls from a Canadian number to a US number with its US certificate ^[10]. The A, B and C values themselves come from the same SHAKEN claim on both sides of the border ^[4].

What is changing (as of October 2026)

The FCC has several open proceedings that could change how attestation works. None of the proposals below appeared as a final rule in a Federal Register search on 28 October 2026.

The July 2026 proposal is the one to watch. If adopted, it would turn today's industry definitions of A, B and C into FCC rules and set out how providers must confirm that a number belongs to the customer. For a business that already calls out through the provider holding its numbers, little should change. For a business that relies on third-party tools displaying its main number, verification could become stricter.

If your business number only receives calls

Many small businesses use their main number mainly for inbound calls: customers call, a menu answers, and the call rings someone's mobile. Attestation applies to calls a provider originates, so the signature on an incoming customer call belongs to the customer's carrier, not to you.

Where attestation does touch you is the callback. If staff return calls from their own mobiles, the customer sees the mobile number, signed by the mobile carrier that issued it. A number the provider assigned to its own customer is the standard's first example of a verified number-to-customer link, the basis for A ^[5]. The trade-off is that customers may not recognise that number. If you want callbacks to show the business number, they need to go out through a provider that can attest to it, which brings you back to the checklist above.

FAQ

Does attestation A guarantee "Verified" or my name on the screen? No. Display is up to the receiving carrier and the phone. The FCC's December 2025 proposal to require verified caller name for A-attested calls is not yet a rule ^[12].

Can I check what level my calls get? Ask your provider; it makes the decision and should be able to tell you. Some platforms expose the result: Twilio reports the attestation it gave an outgoing call in a status callback field, and shows the verification result (for example TN-Validation-Passed-A) on calls it receives ^[11]. A test call to a line that displays this can tell you what arrives.

Do I need to register my business for STIR/SHAKEN? The FCC's STIR/SHAKEN and Robocall Mitigation Database rules apply to providers ^[6][9]. Your part is giving your provider whatever proof it asks for that the number is yours.

Why do my calls get B when the number really is mine? Usually because the provider placing the call did not issue it. Being yours is not enough; the signing provider has to know it is yours.

Is a C rating a sign of wrongdoing? No. C describes where the call came from, such as an international route or a gateway, not the caller's intent ^[4]. It does give the receiving side less to go on.

Does Canada use the same levels? Canada uses the same SHAKEN framework under CRTC Decision 2021-123, with its own governance authority, the CSTGA ^[15]. See the glossary for related terms.

Auto Attendant lines answer inbound calls only and place no outbound calls, so the attestation questions above apply to whatever your team uses to call customers back.

Sources

1. Call Authentication - Federal Communications Commission; what STIR/SHAKEN is, IP-only operation, 2021 deadline, Robocall Mitigation Database for all providers; accessed 2026-10-28, read via Internet Archive copy (19 October 2026).
2. RFC 8224: Authenticated Identity Management in the Session Initiation Protocol (SIP) - IETF, February 2018; signing mechanism; verification does not entail treatment (section 6.2.1); accessed 2026-10-28.
3. RFC 8588: PASSporT Extension for SHAKEN - IETF, May 2019; A, B and C attest values and wording; accessed 2026-10-28.
4. 47 CFR 64.6301 Caller ID authentication - eCFR; June 30, 2021 deadline; provider makes all attestation-level decisions; accessed 2026-10-28 via the eCFR API (text as of 2026-10-26).
5. 47 CFR 64.6302 Caller ID authentication by intermediate providers - eCFR; gateway and intermediate provider duties; accessed 2026-10-28 via the eCFR API.
6. 47 CFR 64.6303 Caller ID authentication in non-IP networks - eCFR; upgrade or non-IP solution alternative; accessed 2026-10-28 via the eCFR API.
7. 47 CFR 64.6305 Robocall mitigation and certification - eCFR; provider robocall mitigation programs and database certification; accessed 2026-10-28 via the eCFR API.
8. Call Authentication Trust Anchor (FCC 24-120), Final rule - Federal Register, 19 August 2025; third-party authentication conditions, effective 18 September 2025; accessed 2026-10-28.
9. Call Authentication Trust Anchor (FCC 25-25), Proposed rule - Federal Register, 16 June 2025; proposed non-IP caller ID authentication; accessed 2026-10-28.
10. Advanced Methods To Target and Eliminate Robocalls (FCC 25-76), Proposed rule - Federal Register, 5 December 2025; proposed verified caller name for A-attested calls; accessed 2026-10-28.
11. Improving the Effectiveness of the Robocall Mitigation Database; CORES Registration System, Final rule - Federal Register, 6 January 2026; database accuracy duties and base forfeitures; accessed 2026-10-28.
12. Enhancing Know-Your-Upstream-Provider Requirements and Strengthening STIR/SHAKEN (FCC 26-32), Proposed rule - Federal Register, 9 July 2026; proposal to codify attestation levels and number-to-customer verification; accessed 2026-10-28.
13. Compliance and Enforcement and Telecom Decision CRTC 2021-123 - CRTC, 6 April 2021; Canadian STIR/SHAKEN condition of service effective 30 November 2021, CSTGA; accessed 2026-10-28, read via Internet Archive copy.
14. Trusted Calling with SHAKEN/STIR - Twilio Docs; plain-language A/B/C definitions, verification results, forwarding behaviour; accessed 2026-10-28.
15. Attestation behavior - Telnyx Developers; owned vs non-owned numbers, transfers, forwarding, US and Canadian certificates; accessed 2026-10-28.
16. ATIS-1000074.v003, Signature-based Handling of Asserted information using toKENs (SHAKEN) - ATIS and SIP Forum; clause 5.2.4 normative A, B and C conditions; accessed 2026-10-28.
17. Compliance and Enforcement and Telecom Decision CRTC 2025-343 - CRTC, 16 December 2025; ended semi-annual STIR/SHAKEN reporting for most providers; accessed 2026-10-28, read via Internet Archive copy.