STIR/SHAKEN Explained: Why Your Business Calls Get Marked “Spam” (and How to Fix It)
Published on July 8, 2026
STIR/SHAKEN is the caller ID authentication framework that decides whether your business calls show up as a trusted number or get flagged as "Spam Likely." If your calls are getting mislabeled, or you're choosing a new phone provider, this is the single most important thing to understand in 2026. Here's what it is, how it works, and exactly what it means for your business.
What Is STIR/SHAKEN?
STIR/SHAKEN is a set of technical standards that let phone carriers cryptographically verify that the caller ID on a call is legitimate and hasn't been spoofed. The acronyms stand for Secure Telephone Identity Revisited (STIR) and Signature-based Handling of Asserted information using toKENs (SHAKEN).
In plain terms: when your business places a call, your voice provider attaches a digital signature vouching for your caller ID. As the call passes across networks, each carrier can verify that signature. The phone company delivering the call to the recipient checks the signature and decides how much to trust the displayed number. This is what stops scammers from impersonating your number — and what keeps your legitimate calls from being lumped in with them.
The Three Attestation Levels
Every authenticated call carries an "attestation level" that signals how confident the originating provider is in the caller ID. This is the heart of the system.
| Level | Name | What it means |
|---|---|---|
| A | Full Attestation | The provider knows the customer and confirms they have the right to use the calling number. Highest trust. |
| B | Partial Attestation | The provider knows the customer but cannot confirm they own the specific number. |
| C | Gateway Attestation | The provider is just passing the call through (e.g. from an international gateway) and can't vouch for the caller. Lowest trust. |
The goal for any business is to place calls that receive Attestation A. Calls with B or C attestation are far more likely to be filtered, labeled, or dropped by the receiving carrier's analytics.
Who Is Actually Required to Comply?
This is the most common point of confusion, so let's be precise:
STIR/SHAKEN obligations apply to voice service providers, not to the businesses that use them.
If you buy SIP trunking, hosted PBX, or cloud calling from a provider, you are not required to implement STIR/SHAKEN yourself. Your responsibility is to choose a provider that has properly implemented it and can sign your calls with full A-level attestation. The provider handles the certificates, the signing infrastructure, and the regulatory filings.
The Robocall Mitigation Database (RMD)
Voice providers must register in the FCC's Robocall Mitigation Database and certify their robocall-mitigation practices. A key change to know about in 2026: annual RMD recertification is now required, with the recertification window opening February 1 and the deadline on March 1. Providers who let their RMD registration lapse can have their traffic blocked by downstream carriers — which directly affects whether your calls get delivered.
When you evaluate a provider, ask them directly whether their RMD registration is current.
Why Your Legitimate Calls Still Get Marked as Spam
Here's a hard truth: full STIR/SHAKEN attestation does not guarantee your calls won't be labeled "Spam Likely." Attestation A tells the network the caller ID is authentic — but the reputation of the number is scored separately by analytics engines (like those from Hiya, TNS, and First Orion) that the major carriers use.
A number can be perfectly authenticated and still be flagged if it:
- Places a high volume of short-duration calls
- Has a lot of calls that go unanswered or are rejected quickly
- Has been reported by recipients
- Is newly activated with no calling history
The fix is a combination of proper attestation (your provider's job) and good calling hygiene (your job): reasonable call volumes, branded caller ID where available, and monitoring your numbers' reputation.
How to Choose a Compliant Provider
When you're shopping for a business phone system, put these questions to any provider:
- Do you sign all of my outbound calls with Attestation A? If they can't say yes, your caller ID is at risk.
- Is your Robocall Mitigation Database registration current? It must be recertified annually.
- Do you offer branded caller ID or number reputation monitoring? These directly reduce spam labeling.
- What happens to calls you can't fully attest? You want a provider that owns its numbers and knows its customers, not one reselling anonymous trunks.
STIR/SHAKEN and SIP Trunking
If you run your own PBX and buy SIP trunks, attestation depends on the trunk provider knowing that you legitimately control the numbers you send as caller ID. Sending a caller ID you don't own — even by accident, from a misconfigured PBX — will drop your attestation and hurt deliverability. Work with a provider that provisions your DIDs properly and validates your outbound caller ID against the numbers assigned to you.
Frequently Asked Questions
Does STIR/SHAKEN stop all robocalls? No. It authenticates caller ID so spoofed calls can be identified and traced, but it doesn't block calls by itself. It's one layer of a broader robocall-mitigation strategy.
Do I need to file anything with the FCC for STIR/SHAKEN? Not as an end-user business. The filing and Robocall Mitigation Database obligations fall on your voice service provider.
Why is my authenticated number still showing "Spam Likely"? Attestation and reputation are two different things. Your number can be fully authenticated but still carry a poor analytics reputation. Address it with calling hygiene, branded caller ID, and reputation remediation.
Does this apply to calls made over a landline / TDM network? STIR/SHAKEN operates on the IP portions of networks. Calls that traverse older TDM segments can't be signed end-to-end, which is one reason attestation sometimes degrades.
The Bottom Line
STIR/SHAKEN is now the backbone of caller ID trust in the U.S. phone network. As a business, you don't implement it — but the provider you choose absolutely determines whether your calls arrive trusted or get buried under a spam label. At YonderTele, every outbound call is signed with full attestation, our robocall-mitigation registration is kept current, and we help you keep your numbers' reputation clean.
Want to make sure your calls actually get answered? Get started with YonderTele and we'll audit your caller ID setup for free.