STIR/SHAKEN Attestation Levels Explained: What to Demand From Your SIP Carrier
If your outbound answer rates have been sliding and you've already ruled out list quality, dial pacing, and time-of-day targeting, look at your attestation level before you look at anything else. In 2026, attestation is no longer a compliance checkbox — it's the single biggest lever a carrier controls over whether your calls ring through at all.
Most call center operators know STIR/SHAKEN exists. Far fewer understand how attestation actually gets assigned, why their "compliant" trunk is still landing on B-level, or what questions to ask a SIP provider before signing a contract. This is the practical version: what the attestation levels mean operationally, how to audit what you're actually getting, and how it connects to the AMD and connect-rate work you're already doing.
The Three Attestation Levels, Without the Standards-Body Language
Every outbound call gets signed by the originating carrier with one of three attestation levels, embedded in the SIP Identity header. Terminating carriers and third-party analytics engines (Hiya, First Orion, the carrier-native ones AT&T and T-Mobile run) read that signature before the phone rings.
| Level | What It Means | Who Gets It | Typical Answer Rate Impact |
|---|---|---|---|
| A (Full Attestation) | Carrier authenticated the caller, confirmed the caller has the right to use that specific number, and originated the call directly | Direct carrier customers with verified number ownership | Baseline — full trust |
| B (Partial Attestation) | Carrier authenticated the caller but cannot verify the caller owns or is authorized to use that specific number | Resellers, some SIP trunk wholesalers, calls from customers not directly provisioned by the signing carrier | 10-20% lower answer rate vs. A-level |
| C (Gateway Attestation) | Carrier can't verify the caller's identity or number authorization at all — typically international gateway traffic or calls from an untrusted upstream | Gateway/transit traffic, calls entering the US network from an unverified source | Frequently blocked outright or heavily filtered |
The gap between A and B isn't cosmetic. Analytics engines assign trust scores per number and per calling pattern, and attestation level is one of the few signals they can verify cryptographically rather than infer from behavior. A B-level number has to work harder — cleaner calling patterns, lower volume, better answer-to-dial ratios — just to get the same treatment an A-level number gets by default.
Why Your Trunk Might Be Stuck on B-Level
If you're not getting A-level attestation, it's almost always one of these:
You're buying trunks through a reseller, not a facilities-based carrier. Resellers who buy wholesale minutes and resell them under their own brand frequently can't pass full attestation to their customers, because the underlying carrier has no direct KYC relationship with you — only with the reseller. Ask directly: "Does your upstream carrier attest calls to A-level for our specific DIDs, or do you inherit B-level from your own reseller status?"
Your numbers aren't provisioned under a verified business identity. Full attestation requires the signing carrier to confirm you're authorized to use the specific calling number. If your DIDs were ported in through a chain of prior owners, or if your account's KYC documentation is thin (no verified business registration, no clean chain of number ownership), carriers will default to B-level even on a direct connection.
You're originating calls through a gateway that strips or downgrades the signature. This is the "TDM-in-the-middle" problem — when a call transits legacy time-division multiplexed infrastructure or an intermediate carrier that doesn't support SHAKEN passthrough, the attestation gets dropped or re-signed at a lower level by the next hop. Industry estimates put a majority of nominally-signed calls losing verified attestation somewhere in the path to the terminating carrier.
You're using a high volume of newly acquired or recycled numbers. Even with A-level signing, brand-new numbers with no calling history carry less trust with analytics engines than established numbers with a clean track record. Attestation and number reputation are related but separate — see our guide on caller ID reputation management for the reputation side of this.
What to Ask a SIP Carrier Before You Sign
Most SIP trunk sales calls won't volunteer this information — you have to ask directly, and you want it in writing, not just verbally confirmed:
- "What attestation level do you assign to outbound calls from our account, by default?" Get a specific answer: A, B, or C. "It depends" is not an answer — ask them to commit to what it will be for your traffic pattern.
- "Are you a facilities-based carrier, or are you reselling capacity from an upstream provider?" Facilities-based carriers with direct SS7/IP interconnection agreements are far more likely to deliver consistent A-level attestation than multi-hop resellers.
- "What KYC documentation do you require to assign A-level attestation to our DIDs?" A carrier that asks for almost nothing beyond a credit card is a carrier that can't vouch for you to the terminating network either.
- "Can you provide SIP trace logs showing the Identity header and attestation level on a sample of our outbound calls?" This is the verification step most operators skip. Don't take the sales rep's word for it — get actual call trace data.
- "What happens to attestation on international or multi-carrier routes?" If any portion of your traffic transits outside a single carrier's network, ask specifically how attestation is preserved or re-signed at each hop.
Verifying Your Actual Attestation Level
Don't rely on carrier claims — verify it yourself. If you're running Asterisk or FreePBX, you can inspect the Identity header on outbound SIP INVITE messages directly:
sngrep -c
# or
tcpdump -i any -A 'port 5060' | grep -A2 "Identity:"
The Identity header contains a base64-encoded JWT with an attest field set to A, B, or C. If you're seeing anything other than A on calls you expect to be fully attested, that's your starting point for a carrier conversation — bring the trace logs to them, not just a complaint about answer rates.
For VICIdial shops specifically, this is worth checking at the trunk level for every carrier in your routing table, not just your primary — mixed attestation across carriers is common and makes it hard to diagnose why some campaigns underperform others with identical lists and pacing.
Where This Connects to AMD
Attestation determines whether your calls get through the network filter at all. Once a call actually rings and gets answered, a completely separate problem takes over: whether your dialer correctly identifies that answer as a live person versus voicemail. These are sequential gates, not competing priorities — fixing one doesn't fix the other, and teams that focus exclusively on attestation while running default Asterisk AMD often see their answer rate improve while their connect rate to live agents barely moves, because 15-25% of those newly-arriving answers are still getting misrouted as answering machines or, worse, live people getting dropped into a beep-detection pause that plays as dead air.
If you've already tightened attestation and carrier selection and you're still leaking connects, the AMD layer is the next place to look. amdify.io replaces Asterisk's default acoustic AMD with a purpose-built AI model that cuts false positive rates from the 15-25% baseline down to 1-3%, so the calls that do get through — the ones you worked hard to get A-level attestation on — actually land with an agent instead of a premature hangup or a wasted voicemail drop. Combined with a clean attestation and number reputation strategy, that's the full stack for maximizing what portion of your dial list turns into an actual conversation. Learn more at amdify.io.