STIR/SHAKEN Doesn't Stop Spam Likely Labels
STIR/SHAKEN verifies who's calling, not whether it's spam. What A-C attestation means, which vendors grant A by default, and the separate registry that stops spam labels.
Is it right for you?
Your checks are saved on this device only — they reset if you clear browser data or switch devices.
What the protocol actually checks
STIR/SHAKEN is a caller ID authentication protocol the FCC required voice providers to roll out between 2021 and 2023, and by now it should already be running on the network behind whatever business phone system a company uses. What it verifies is narrow: that the number showing up on a recipient's screen actually traces back to the carrier that originated the call, not that the caller is trustworthy or that the call itself is legitimate. A phone system can pass STIR/SHAKEN with the highest attestation grade and still have its calls labeled Spam Likely, because a separate set of carrier analytics engines, not the authentication protocol, decides that label. Buying a VoIP or cloud phone system means checking both systems, not assuming one covers the other.
The name comes from two overlapping technical efforts: STIR (Secure Telephony Identity Revisited), a set of protocols an IETF working group built for authenticating caller ID, and SHAKEN (Signature-based Handling of Asserted information using toKENs), the implementation specification ATIS and the SIP Forum produced so carriers apply those protocols consistently [FCC, Third Further Notice of Proposed Rulemaking, WC Docket No. 17-97, released 2021-04-29]. In practice, the originating carrier cryptographically signs each outbound call with one of three attestation levels, and the terminating carrier checks that signature before the call reaches a phone.
A-level, or full attestation, means the originating carrier has verified both where the call is coming from and that the caller is authorized to use that specific number. B-level, or partial attestation, means the carrier can confirm the call originated on its own network but cannot confirm the caller has the right to use that number, the situation for calls routed through some reseller or unregistered VoIP accounts. C-level, or gateway attestation, is the weakest signal: the carrier can only confirm it received the call and passed it along, with no way to verify where it actually originated, typically international calls entering the U.S. network through a gateway carrier [TransUnion; TelcoBridges, cross-referenced, accessed 2026-09-10].
The two deadlines, both already behind you
The FCC set June 30, 2021 as the deadline for the largest voice service providers, the sort that would answer to AT&T, Verizon, Comcast, and T-Mobile scale, to implement STIR/SHAKEN in the IP portions of their networks [FCC News, 'STIR/SHAKEN Broadly Implemented Starting Today,' 2021-06-30]. Small voice service providers, defined as those with 100,000 or fewer subscriber lines, a category that covers most of the regional carriers and VoIP resellers that actually route small-business phone traffic, got a two-year extension to June 30, 2023 [FCC News, 2021-06-30; FCC Third Further Notice of Proposed Rulemaking, WC Docket No. 17-97, 2021-04-29].
Compliance runs through a separate filing, the Robocall Mitigation Database (RMD), which the FCC launched in April 2021. Every voice provider, whether it had implemented STIR/SHAKEN or was still working through robocall mitigation steps of its own, had to certify its status there by June 30, 2021. Beginning September 28, 2021, any provider whose certification did not appear in the database could no longer have its traffic accepted directly by other voice providers, which effectively cut unregistered carriers off from the rest of the phone network [FCC News, 2021-06-30].
For a business shopping for a VoIP or cloud phone system in 2026, both deadlines have already passed for the entire industry that could plausibly sell that system. The FCC did spend part of 2021 debating whether to shorten the small-provider extension further for a subset of high-volume originators, but that was a proposal circulated for comment, not a rule that changed the underlying June 30, 2023 date for the class as a whole [FCC Third Further Notice of Proposed Rulemaking, WC Docket No. 17-97, 2021-04-29]. What that leaves a buyer to actually check isn't whether a vendor 'supports STIR/SHAKEN,' a box every legitimate provider can now check, it's what attestation level that vendor's calls carry by default, which turns out to vary by vendor.
Full attestation doesn't mean 'not spam'
STIR/SHAKEN and the 'Spam Likely' label a phone shows are two different systems built by two different sets of companies. Attestation is cryptographic and carrier-side; the spam label comes from analytics engines run by companies like Hiya, First Orion, and Transaction Network Services, the three firms that jointly built the industry's original Free Caller Registry, a database business numbers can register in specifically to reduce false spam flagging [Hiya company blog, 'What Is Free Caller Registry and What Does It Do?,' accessed 2026-09-10]. Those analytics models watch calling behavior, not signatures: an unusually fast dial rate, a burst of short-duration calls, or a spike in recipient block-and-report actions can get a fully A-attested number flagged anyway [3Tree Technology; Aloware, cross-referenced, accessed 2026-09-10].
The FCC said as much the day it announced broad implementation: "While STIR/SHAKEN will improve the quality of caller ID information, it does not mean the call itself is legitimate... This improved information will help verify the phone number from which the call was made, or flag that it is not verified, and help blocking services both at the consumer level and before the call reaches the consumer" [FCC News, 2021-06-30]. That second half is the part a buyer needs: STIR/SHAKEN feeds the blocking and labeling systems as one input, it isn't the labeling system itself.
Hiya launched its own free registration tool, Hiya Number Registration, on July 31, 2024, positioned as a superset of Free Caller Registry that adds self-service status checks and management, since the older registry gives businesses no confirmation their submission actually went through or stayed current [Hiya company blog, accessed 2026-09-10]. Either registry runs independently of whatever attestation level a phone system vendor delivers, which means the two are worth treating as separate line items when evaluating a provider, not one.
What vendors actually do differently
How much of this a vendor actually handles varies more than most pricing pages let on. RingCentral says its system signs every call that originates on its network and has filed its STIR/SHAKEN certification in the FCC database, adding that there's no action required on the customer's part for calls to be attested [ringcentral.com blog, 'STIR/SHAKEN: How We Drastically Reduce Robocalls,' updated 2025-03-13]. OpenPhone, rebranded to Quo, ties full attestation to a business-registration step it runs on the customer's behalf: any workspace that completes carrier registration through Quo gets A-level attestation, and the company says it proactively emails high-volume outbound callers to prompt that registration rather than waiting for a spam complaint [quo.com blog, 'STIR/SHAKEN: How New FCC Protocols Can Affect High Volume Outbound Callers,' published 2025-07-21].
JustCall draws the clearest line between the two outcomes. Its own help center states that a number without completed Business Profile and STIR/SHAKEN registration in its Compliance Center "will receive B-level (Partial) Attestation," and that this "frequently causes carriers to flag your calls as Spam Likely or Scam Likely," explicitly noting the registration is not legally required by the FCC but is recommended by the vendor itself [help.justcall.io, 'Avoid Spam on Your JustCall Numbers,' accessed 2026-09-10]. The call still connects either way, B-level attestation isn't a block, it just carries a weaker signal that carrier analytics engines read as reason for suspicion. A team that skips that registration step because a sales page said 'STIR/SHAKEN compliant' can end up running an outbound campaign on B-level numbers without realizing it.
Keeping A-level attestation once you have it
Registering for A-level attestation is a one-time step; keeping it isn't. Quo and JustCall publish overlapping guidance on this, and the overlap itself is a useful signal that these aren't vendor-specific quirks. Ramp a new number's outbound volume gradually instead of hitting full campaign volume on day one, since a sudden spike from zero to high volume is one of the behaviors analytics engines watch for regardless of attestation level [quo.com blog, 2025-07-21; help.justcall.io, accessed 2026-09-10]. Keep calling lists current and remove numbers that never connect, since low answer and completion rates feed the same reputation models. Avoid using local-prefix numbers that match a destination area code across a large call list, a pattern both companies flag as neighbor spoofing that carriers monitor closely because scammers rely on it too.
JustCall's guidance gets specific enough to cite an outside legal threshold as a reference point for what counts as too frequent: it points to the Fair Debt Collection Practices Act's own rule of thumb, eight calls to the same number within seven consecutive days counting as harassment, as an example of a frequency ceiling regulators already recognize, even for businesses outside debt collection [help.justcall.io, accessed 2026-09-10]. Numbers reassigned to a new purpose should sit idle for at least 45 days before reuse, the same guidance adds, since a number's calling history carries forward with it. None of this replaces the call recording consent rules or the 3% abandonment rate cap that apply to the same outbound calling programs; attestation, consent law, and abandonment-rate compliance are three separate checklists that happen to apply to the same phone call.
FAQ
Do I need to personally set up STIR/SHAKEN for my business?
No. Implementation sits entirely on the carrier side of a phone contract, not with the company paying for the line [FCC, Jun 2021]. The thing worth confirming during a purchase is which tier of caller verification a given provider defaults to and whether reaching the strongest tier needs an extra step from you, since that answer differs vendor to vendor.
What's the actual difference between STIR/SHAKEN and something like Hiya?
STIR/SHAKEN is a cryptographic signature the carrier placing a call attaches to it, confirming where that call came from. Hiya and the older spam-reputation registry it built on sit on top of that as databases run by the analytics vendors that decide the Spam Likely label itself, and signing up for one of those is a separate action from anything a phone provider does automatically [Hiya, 2026].
If both FCC deadlines already passed years ago, why does this still matter for a 2026 phone system purchase?
Because a deadline standardized when providers had to implement the protocol, not how well each one did it. A carrier's RMD filing can stay current while its default for a brand-new customer number still sits at B-level until that customer completes a separate step, exactly the setup JustCall's help documentation describes for accounts that never complete that registration [JustCall help center, 2026]. Passing the deadline proves the underlying infrastructure exists, not that a given vendor defaults you to its strongest version.
What happened to providers that never filed with the RMD?
From September 28, 2021 onward, other carriers were required to stop accepting traffic handed to them directly by any provider missing from that filing, a rule that locked any missing filer out of most of the country's call routing [FCC, Jun 2021]. Anything still carrying calls today almost certainly cleared that bar years ago, though clearing it says nothing about which attestation grade it hands a customer by default.
Will full attestation stop my calls from getting blocked or flagged?
No, and the FCC has said so on the record: authentication tells a recipient's carrier where a call originated, it does not vouch for whether that call is one worth picking up [FCC, Jun 2021]. A number carrying the strongest verification tier can still pick up a Spam Likely tag from a carrier's separate behavior-analytics engine, which is exactly why pairing that verification with a reputation registry and disciplined calling volume still matters once the paperwork side is settled. See what branded caller ID actually costs for the separate step of putting your business name on the screen instead of just clearing the spam flag.