STIR/SHAKEN Attestation in 2026: Why Calls Get Labeled Spam

October 29, 2026

TL;DR: STIR/SHAKEN attestation tells the far end how well your carrier knows you and your number. It’s an A, B or C, and it’s one input that call analytics engines use when they decide whether to show “Spam Likely.” An A doesn’t guarantee a clean label, because the FCC says a large share of illegal robocalls are A-attested too. In 2026 the FCC is tightening the system: carriers must sign with their own certificates, Robocall Mitigation Database filings are getting real enforcement, and proposed Know Your Upstream Provider (KYUP) rules would set stricter attestation standards. For enterprises, the to-do list is short: get A attestation on numbers you own, make sure your carrier is compliant, and register your numbers with the analytics companies.

If your company’s outbound calls show up as “Spam Likely,” the conversation usually starts with the help desk and ends with a carrier ticket that goes nowhere. Part of the problem is that STIR/SHAKEN, call analytics and spam labels get talked about as if they’re one system. They aren’t. Here’s how the pieces fit together, what the FCC changed and is still changing in 2026, and what an enterprise voice team can actually do about it.

STIR/SHAKEN attestation in plain English

When a call starts on an IP network, the originating provider is supposed to sign it. That signature travels in the SIP Identity header, and the terminating provider checks it. Part of the signature is an attestation level, which is the originating provider vouching for the call. The FCC’s May 2026 KYUP Further Notice of Proposed Rulemaking (FCC 26-32) lays out the three levels in close to plain language:

A, full attestation. The provider is responsible for putting the call onto the IP network, has a direct authenticated relationship with the customer and can identify them, and has established a verified association between that customer and the calling number. In short: “I know this customer, and I know they’re allowed to use this number.”
B, partial attestation. The first two are true, but the provider can’t verify the customer’s right to use that specific number. “I know this customer, but not this number.”
C, gateway attestation. The provider has no relationship with whoever originated the call, as with a call coming in through an international gateway. “I’m just passing this along.”

A common enterprise B scenario, offered as an illustration: your numbers are assigned by one carrier, but your outbound calls leave through a SIP trunk or UCaaS platform from a different provider. The provider signing the call knows you, but has no record tying you to those numbers, so the safe answer is B.

Why your calls get labeled spam

Attestation isn’t a spam score. The “Spam Likely,” “Scam Likely” or “Telemarketing” labels come from analytics engines that carriers and phone makers use. Those engines look at calling patterns, complaint data, number reputation and other signals. The verification result is one of those signals.

The FCC’s own data shows why attestation alone can’t carry the weight. In the KYUP FNPRM, the Commission cites figures that 93.4 percent of robocall traffic from the most prolific robocall signers now carries A-level attestation, and that 48 percent of illegal calls are A-attested. It also points to the Lingo Telecom case, where A attestation was applied to 3,978 deepfake robocalls imitating President Biden. If bad actors can get A attestations that easily, analytics engines can’t simply trust an A.

The FCC also says improper attestations can cause inaccurate blocking or labeling of legitimate calls. In practice, that means a legitimate business can do everything right and still be judged partly by how its carrier, and that carrier’s other customers, handle attestation.

A note on troubleshooting: if a SIP trace shows a missing or malformed Identity header, that’s a signaling problem, the same kind of thing I walk through in SIP One-Way Audio Troubleshooting. Capturing the INVITE on your side of the trunk is still the fastest way to see what your carrier is actually sending.

What the FCC already changed

Third-party signing must use the provider’s own certificate

A lot of smaller voice providers outsourced STIR/SHAKEN signing to a third party. The FCC’s Eighth Caller ID Authentication Report and Order (FCC 24-120) kept that option but tightened it. Under rules that took effect September 18, 2025 (per DA 25-730):

The provider with the obligation to sign still makes every attestation decision, even if a vendor does the cryptography.
Calls have to be signed with that provider’s own certificate, which means every obligated provider needs its own SPC token and certificate.
Providers may only certify in the Robocall Mitigation Database that they’ve implemented STIR/SHAKEN if they actually have their own token and certificate, and they must keep records of their third-party signing arrangements.

The FCC cited a TransNexus estimate that about 64 percent of providers claiming STIR/SHAKEN implementation in the database had no token or certificate of their own. That was the gap this rule closed.

The Robocall Mitigation Database now has teeth

Voice providers file in the Robocall Mitigation Database (RMD), describing their robocall mitigation programs and STIR/SHAKEN status. Two things matter here:

Annual recertification by March 1 under 47 CFR 64.6305, plus updates within 10 business days when filing information changes. The FCC’s base forfeitures are $10,000 for false or inaccurate filings and $1,000 for failing to update, and each continues until it’s fixed.
Second chances, for now. According to The CommLaw Group (October 26, 2026), the FCC has been sending notices to providers that missed the March 1, 2026 recertification, and at least one of those notices set a November 6, 2026 deadline. That’s one firm’s report, so don’t assume it applies to every provider.

Recertification matters to enterprises because the FCC’s rules generally bar downstream providers from accepting traffic from providers that aren’t in the database. In July 2026 the FCC also proposed, in FCC 26-49, automatically suspending or removing providers that miss recertification. That’s still a proposal.

Two hardship extensions survived another year

In DA 26-1050 (September 29, 2026), the Wireline Competition Bureau kept the two remaining STIR/SHAKEN implementation extensions: one for providers that can’t get an SPC token, and one for certain small satellite providers that use NANP numbers. The Bureau kept them in place while the KYUP proceeding considers repealing them.

What the FCC is proposing: KYUP

The KYUP FNPRM was adopted May 20, 2026 and published in the Federal Register July 9, 2026. Comments closed August 10 and replies September 8. As of this writing, these are proposals, not final rules. TransNexus has a good summary. The highlights:

Know Your Upstream Provider. Five baseline steps for vetting the providers you take traffic from: information collection, compliance review, verification, monitoring and responsive action, with records kept for at least four years.
Codified attestation levels. A, B and C would be written into the rules, along with a definition of improper attestation.
Stricter A attestation. The FNPRM proposes specific acceptable ways to verify a customer’s right to a number, such as the provider being the number’s assigned provider or the customer having a delegate certificate. A generic contract clause where the customer promises they’re allowed to use a number, the kind of thing that came up in the Lingo case, wouldn’t be enough.
The provider serving the caller decides. The provider closest to the end user, even a reseller, would make the attestation decision.
No unauthenticated SIP calls. Providers would be barred from accepting unsigned SIP traffic.
Ending the last extensions. Repealing the SPC-token and satellite extensions that DA 26-1050 just kept.

If adopted, the FCC proposed the rules would take effect the later of 12 months after an order is published or 30 days after OMB approval. Watch for a Report and Order.

What enterprises should do now

None of these rules apply directly to an enterprise that just buys phone service. But they decide how your calls are signed and how much the rest of the network trusts them. Here’s a practical checklist:

Ask for A attestation on numbers you own. Ask your carrier, in writing, what level your outbound calls get today, and verify it with a SIP capture or a test call to a service that shows verification results. If you’re getting B, ask what it would take to get A.
Fix the split-provider problem. If your numbers are assigned by one provider and your calls leave through another, ask both about delegate certificates or moving signing to the provider that can verify the numbers.
Check your carrier’s RMD status. The database is public. Confirm your providers are listed, recertified and claiming their own STIR/SHAKEN implementation rather than relying on someone else’s certificate.
Register your numbers. The Free Caller Registry lets a business submit its numbers once to Hiya, First Orion and TNS. Hiya also has its own registration. Registration helps the analytics engines understand who you are. It doesn’t guarantee a label will come off.
Look at branded calling. Displaying a verified business name and logo is becoming the bigger trust signal. The FCC’s Call Branding FNPRM, published in the Federal Register in December 2025, proposed that a consumer-facing A-attestation indicator only be shown when verified caller identity is also delivered. That’s another proposal, but it shows where things are headed.
Behave like a legitimate caller. Consistent caller ID, sensible call volumes per number, and not rotating through numbers matter as much as any certificate.

The takeaway

STIR/SHAKEN was never going to stop robocalls by itself, and the FCC’s own numbers prove it: bad actors have plenty of A attestations. What 2026 changes is accountability. Providers have to sign with their own certificates, keep their database filings current, and, if KYUP is adopted, actually verify who is behind every A. For enterprises, the best defense is boring and effective: own your numbers, get them A-attested, register them, and pick carriers that take compliance seriously.

Sources

Tags:

STIR/SHAKEN in 2026: Why Your Calls Get Labeled Spam and What the FCC Is Changing