Deliverability · 2026

STIR/SHAKEN attestation for cold calling: how to get A-level on Twilio, and what it does not fix

Last updated September 3, 2026

Most STIR/SHAKEN explainers are written for carriers or for compliance officers, and most dialer vendors mention it once, in a sentence that ends with "so use our numbers". A cold caller needs about four facts: what the letters mean, what makes Twilio sign your call with an A instead of a B, whether it costs anything, and why an A-attested number can still show up as Spam Likely. This page gives those four, from Twilio's own SHAKEN/STIR documentation as read in September 2026, and ends with a checklist you can finish in a week.

STIR/SHAKEN in two paragraphs

Caller ID was never authenticated. Any system that could place a call could claim any number, which is how a robocaller in one country shows up as your neighbour's area code. STIR/SHAKEN is the fix the US carriers were required to deploy under the TRACED Act: the carrier that originates a call attaches a cryptographic signature saying, in effect, "I know this customer and here is how confident I am that they may use this number". The carrier that terminates the call checks the signature and passes the result to the handset and to its spam-analytics vendor.

The confidence comes in three grades. A, full attestation: the customer is known and has the right to the number. B, partial: the customer is known, the number is not vouched for. C, gateway: the carrier only vouches that the call entered its network here. Twilio, as the originating carrier for every call your dialer places, decides which letter your call gets, and it decides by looking at what you have registered in Trust Hub. Support is deployed in the US and, per Twilio's docs, France; calls elsewhere carry no signature.

What A, B and C mean when you are the caller

Assignment rules are from Twilio's SHAKEN/STIR onboarding documentation and its 2021 engineering post on signing, both checked September 2026. The rule people miss is in the B row: Twilio states that B is the maximum for a non-Twilio number because it cannot attest your right to a number it does not host. That covers every Verified Caller ID, including your cell.

How Twilio assigns it: Trust Hub, step by step

1. Business Profile. Console → Trust Hub → Business Profiles (Twilio also calls it the Primary Customer Profile). Legal name, address, tax ID or business registration, and an authorised representative. Twilio quotes about 24 hours to vet. This one profile is also the prerequisite for CNAM and for A2P 10DLC texting, so it is worth doing carefully once.
2. SHAKEN/STIR Trust Product. Trust Hub → SHAKEN/STIR(under Trust Products), create it linked to the profile, submit. Twilio quotes up to 72 hours. Since September 2024 Twilio adds the SHAKEN/STIR bundle to newly approved profiles by default, but per the same changelog you still have to assign numbers to get A; the default gets you to B.
3. Assign numbers. Add each Twilio number you dial from to the Business Profile and to the SHAKEN/STIR product. Only assigned numbers sign A. Every number you buy later needs the same two clicks, which is the step teams forget when they add a rep.
4. Sub-accounts. If your dialer or your team uses Twilio sub-accounts, the parent profile gets everything under it to B; A still requires the number to be assigned to a profile.

You can watch it work. Calls into a Twilio number of your own carry a StirVerstat value such as TN-Validation-Passed-A, and Twilio's SDKs can show the indicator on incoming calls, so a test call from your dialer number to a second Twilio number tells you the letter without guessing from a handset. The registration flow sits inside the wider Twilio setup walkthrough.

What it costs

Twilio's pricing pages and the SHAKEN/STIR docs, read September 2026, list no fee for the profile, the trust product or number assignment, and Twilio describes CNAM registration as free; we are stating the absence of a listed fee, not a guarantee, and Twilio can add one. Put together, a fully attested solo setup at 600 billed minutes is about $10 a month of Twilio usage with the software free; a three-rep team on Pro at 1,800 team minutes and three numbers is about $58 all-in ($29 of that is DialSheet). Compare that with a rented-number dialer at ~$30 to ~$65 a user a month whose attestation you do not even own.

Why bring-your-own-Twilio means the attestation is yours

The signature on a call belongs to the identity that registered the number. When a dialer rents you a number from its pool, that identity is the vendor's: their Business Profile, their carrier relationship, their reputation, pooled with every other customer who is dialing hard that week. If the vendor's pool takes a hit, so do you; if you leave, the number and its history stay behind (see what the vendors themselves say on using your own number with a power dialer). Typically the best a rental delivers is B, because the vendor is presenting a number on behalf of a customer it has vetted only lightly, and several vendors say as much in their own spam-label posts.

On your own Twilio account every one of those nouns is yours: the profile is your legal entity, the numbers are on your invoice, the CNAM is your name, the analytics reputation is only your calling behaviour, and the signature is A because Twilio can see that the number and the profile match. It moves with you. Switching dialers is pasting the same Account SID and Auth Token somewhere else; the attestation does not notice. That portability is most of the case for a dialer that runs on your Twilio rather than on the vendor's, and it is the reason DialSheet is built that way. It is, as far as we can find, the only free power dialer that runs on your own Twilio account.

Attestation is not spam labelling

These are two systems that people conflate because they show up on the same screen. Attestation is identity: the originating carrier says who you are. Labelling is behaviour: the terminating carrier's analytics vendor says whether you act like a nuisance. Three private companies do most of that scoring in the US (by their own accounts: Hiya for AT&T, TNS Call Guardian for Verizon, First Orion for T-Mobile). Their inputs are volume per number, answer rate, average call duration, complaint reports, honeypot hits and the attestation level. A is one input, and a positive one. Four hundred short, unanswered dials a day from a single number is a larger, negative one, and the label lands regardless of the letter.

So the order of operations for a cold caller is: get A, register the name, then run a calling pattern the engines read as a business rather than a robot. What that pattern looks like in dials per day is in how many calls a day before Spam Likely, and the ramp for a fresh number is in warming up a phone number. The three engines also run a joint portal, freecallerregistry.com, where you register your numbers, display name and call category at no cost; it does not clear an existing label on its own, but it gives the scorers a business to attach your traffic to.

The checklist

1. Upgrade the Twilio account off the trial; Trust Hub vetting is for paid accounts.
2. Trust Hub → Business Profile: legal entity name exactly as registered, physical address, tax ID, authorised representative. Mismatches are the common rejection.
3. Trust Hub → SHAKEN/STIR: create the Trust Product linked to the profile and submit. Wait for both approvals (about 24 h and up to 72 h per Twilio).
4. Assign every Twilio number you dial from to the Business Profile and to the SHAKEN/STIR product. Repeat for each number you buy later; new numbers are not attested automatically.
5. Trust Hub → Registrations → CNAM: register a 15-character display name so landlines and some mobiles show a company, not a bare number.
6. Register the same numbers and name at freecallerregistry.com so the three analytics engines have your identity on file before they see your traffic.
7. Place a test call to a phone on a major US carrier and look for the verified indicator. Or check the StirVerstat value Twilio reports on calls into a Twilio number of your own.
8. Then behave like a business: one number per rep, sane daily volume per number, callbacks answered, a DNC scrub before every list. Attestation earns you the benefit of the doubt; pattern keeps it.

Questions people actually ask