STIR/SHAKEN and VICIdial: What You Need to Know

If your outbound numbers keep showing up flagged or your answer rates dropped without an obvious cause, STIR/SHAKEN is part of the story. It is the framework carriers use to sign and verify the caller ID on a call, and it directly affects whether your calls land clean or get tagged as suspicious.

This post explains what STIR/SHAKEN is in plain terms, what it does and does not do, and where it touches a VICIdial dialer. The short version: most of the signing happens at your carrier, and VICIdial's job is to send a number you are actually allowed to use.

What STIR/SHAKEN actually is

STIR/SHAKEN is a pair of standards for cryptographically signing the caller ID on a phone call. When you place a call, the originating carrier attaches a signed token, carried in a SIP header called Identity, that vouches for the number. Each carrier the call passes through can check that signature and decide how much to trust the displayed number. This is Call attestation, and it is why spoofed numbers are getting harder to push through.

There are three attestation levels. Full (A) means the carrier knows you and confirms you own the number. Partial (B) means the carrier knows you but cannot confirm the number. Gateway (C) means the carrier is just passing the call along and vouches for almost nothing. Calls with low attestation are far more likely to be labeled spam by the terminating carrier.

Why it matters for your answer rates

Attestation feeds directly into the spam-labeling systems on mobile networks. A call signed with A attestation from a number tied to your business is treated as legitimate. A call with C attestation, or a Caller ID spoofing mismatch where the number you send is not one your carrier recognizes, is a strong candidate for a Spam Likely tag.

So the practical lever is simple: send caller IDs that your carrier knows you own. The cleanest path to full attestation is using numbers your provider issued to you, not borrowed or rotated numbers it has no record of. For the labeling side of this, mitigating Spam Likely tags goes deeper.

sequenceDiagram
  participant V as VICIdial
  participant O as Originating carrier
  participant T as Terminating carrier
  participant P as Called phone
  V->>O: Place call with caller ID
  O->>O: Sign caller ID, set attestation
  O->>T: Forward call with Identity header
  T->>T: Verify signature
  T->>P: Deliver call, maybe label spam

Where VICIdial fits in

The signing itself is the carrier's job, not the dialer's. VICIdial's role is to present a caller ID and route the call out the SIP trunk in a format the carrier accepts. That said, VICIdial can integrate with a third-party signing service that runs an AGI script before each call to tag it with SIP headers, including the Identity value, so the call carries attestation data your carrier can route on.

That integration also unlocks optional checks, like a Do-Not-Call lookup, a disconnected-number check, and caller ID validation, and it introduces carrier-defined call statuses for those outcomes. It is an advanced add-on rather than a default. The deeper hands-on setup lives in the STIR/SHAKEN API integration walkthrough.

A short checklist

• Use caller IDs your carrier issued to you, so you qualify for full attestation.
• Ask your carrier what attestation level your calls actually receive; many will tell you.
• Treat a sudden spam-label spike as a signal to audit your numbers, not just your script.

Carrier choice matters here too, because attestation support and number ownership vary by provider. The carrier integration guide covers the wider setup, and choosing a SIP carrier helps you pick one that handles attestation well.

Wrapping up

STIR/SHAKEN signs your caller ID so terminating carriers can trust it, and good attestation protects your answer rates. VICIdial sends the number; your carrier signs it; clean number ownership is what earns you full attestation.

VICIfast provisions a managed VICIdial box in under 40 seconds with the carrier and dialplan hooks ready, so wiring in a signing service is configuration, not a server rebuild. View pricing to get started.