STIR/SHAKEN is a caller ID authentication framework that uses digital certificates to verify a call actually originates from the number it displays, helping combat IP spoofing and verify call authenticity. Canada has mandated it for IP-originated voice traffic since 2021, and the CRTC recently swapped blanket semi-annual reporting for targeted requests aimed at providers still catching up. If you run phone systems for a Canadian business, your next move is simple: confirm with your provider that calls are signed and ask what attestation level they assign to your traffic.
TL;DR:
- Most Ontario businesses should confirm with their provider that outgoing calls are signed and identify the attestation level assigned to their numbers.
- Full attestation ('A') requires verified number ownership and is essential for call centers and enterprises, while 'B' and 'C' levels indicate lower trust signals.
- Proper setup at installation — including documentation, trunk choice, and signing at the source — is crucial to maintain high attestation levels and prevent calls from being mislabeled.
- Regularly testing SIP headers and monitoring call signing rates help detect drift or issues before customer calls are blocked or flagged.
- The regulator has shifted to targeted requests instead of semi-annual reports, emphasizing the importance of internal metrics like signed call rate and attestation mix for compliance.
Table of Contents
- What STIR/SHAKEN Does for Canadian Calls
- How CRTC Rules Have Evolved Through 2026
- Certificates, Signing Points, and SIP Trunk Decisions
- Who Handles What: A Compliance Checklist
- What Verified Caller ID Actually Buys You
- Why Legitimate Calls Get Mislabeled
- Tracking Compliance Without Waiting for a Regulator Call
- Getting Signing Right Starts With the Install, Not the Contract
- Get a Phone System That Signs Calls Correctly From Day One
- Sources
- FAQ
What STIR/SHAKEN Does for Canadian Calls
STIR/SHAKEN doesn't block spam. It signs calls with cryptographic proof of origin, then lets the receiving network decide what to do with that proof. Every call leaving a signing-capable network gets an encrypted signature attached to its SIP header, and the terminating carrier checks that signature before the phone ever rings.
The system runs on two components. STIR (Secure Telephone Identity Revisited) is the technical standard for signing and verifying calls, defined in RFC 8224. SHAKEN (Signature-based Handling of Asserted information using tokens) is the governance framework that tells carriers how to apply STIR across their networks. Together they answer one question for the network on the other end: can this call's origin be trusted?
That trust comes in three tiers, called attestation levels:
- A (Full Attestation): The originating provider knows the caller, verified the phone number belongs to them, and confirms they're authorized to use it. This is what call centers and enterprises should be targeting.
- B (Partial Attestation): The provider knows the customer but can't confirm they're authorized to use the specific number, common with some hosted PBX setups and shared trunk arrangements.
- C (Gateway Attestation): The call entered the network from an international gateway or another carrier with no way to verify the source. This is the weakest signal and the one most likely to trigger downstream filtering.
The framework has real edges. It only covers IP-originated calls, so traffic that touches a traditional PSTN gateway anywhere in its path often loses its signature. And it only works when both networks participate, which means calls from providers outside the STIR/SHAKEN ecosystem, particularly some international carriers, arrive unsigned no matter how clean your own setup is.
How CRTC Rules Have Evolved Through 2026
Canadian carriers have been under a formal STIR/SHAKEN obligation since the CRTC's 2021 decision, which required telecommunications service providers to implement authentication for IP-based voice calls. That decision set the baseline: sign what you can, verify what you receive, and report your progress to the regulator.
The compliance picture shifted with Telecom Decision CRTC 2025-343. Instead of requiring every TSP to file semi-annual status reports indefinitely, the CRTC now reserves that ongoing obligation for providers still early in their rollout. Most established TSPs move to a targeted request model, where the regulator asks for specific information only when it needs it, rather than collecting standing paperwork twice a year. That's a meaningful signal: the CRTC treats major carrier implementation as largely mature and is redirecting its oversight toward the providers still lagging.
Who's actually in scope? A few things to keep straight:
- The mandate applies to Canadian TSPs originating or terminating voice calls over IP networks.
- Calls that never touch IP infrastructure, purely legacy TDM traffic, fall outside the technical requirement, though that traffic is shrinking fast as carriers modernize.
- Resellers and smaller VoIP providers riding on top of a larger carrier's network typically inherit that carrier's signing capability, but attestation quality depends on how well the reseller documents its own customers.
For governance and participation details, the Canadian Secure Token governance authority (CST-GA) is the body coordinating deployment across the country. If you're a provider trying to figure out registration, certificate authority selection, or how your obligations map onto the national framework, CST-GA is the authoritative starting point, not a blog post or a reseller's sales page.
Certificates, Signing Points, and SIP Trunk Decisions
Every signed call depends on a public key infrastructure (PKI) chain. A certificate authority issues a digital certificate to a telecommunications provider, that provider uses its private key to sign outgoing calls, and the receiving network uses the public key to verify the signature matches. The technical mechanics live across RFC 8224, RFC 8225 (the PASSporT token format), and RFC 8226 (certificate management), with RFC 8588 covering how personal assistance and enterprise identity gets represented in more complex signing chains.
For IT staff deciding how signing happens on their end, there are generally three paths:
- Provider-side signing. Your carrier signs every call as it leaves their network. This is the simplest option and the one most small and mid-size businesses default to, since it requires no work on your end beyond confirming the provider actually does it.
- Enterprise PBX signing. Larger organizations with their own SIP infrastructure can sign calls before they hit the carrier, useful for multi-site operations that want consistent attestation across locations regardless of which trunk a call happens to route through.
- Gateway signing. Calls entering from a session border controller or gateway get signed at that point, often at a lower attestation level unless the gateway operator has verified the underlying caller.
SIP trunk choice matters more than most IT managers assume. A hosted PBX riding on a shared trunk pool can struggle to earn 'A' attestation if the carrier can't confirm which specific numbers belong to which customer. Dedicated trunks tied to documented, owned numbers are the more reliable path to full attestation, particularly for outbound-heavy operations like call centers or appointment reminder systems.
Pro Tip: Before signing any new SIP trunk agreement, ask the provider point blank what attestation level they assign by default and what documentation they need from you to bump it to 'A'. Vague answers here are a warning sign, not a technicality.
Number documentation is the quiet requirement that trips up a lot of businesses. Carriers assign attestation based on how confident they are that you own and control a number. That means Know Your Customer (KYC)-style verification, proof of number assignment, and consistent account records all feed directly into whether your outbound calls arrive labeled trustworthy or suspicious.
Who Handles What: A Compliance Checklist
STIR/SHAKEN compliance splits cleanly between provider obligations and enterprise responsibilities, and confusing the two is where a lot of implementations stall.
On the TSP side:
- Maintain valid signing certificates and renew them before expiration, since an expired certificate silently drops your signature without warning.
- Set a clear attestation policy that maps customer verification tiers to A, B, or C levels, and apply it consistently rather than case by case.
- Participate in industry traceback efforts when asked, since refusing to cooperate on suspicious traffic investigations can draw direct regulatory attention.
- File any required mitigation or progress reports if you fall into the group CRTC 2025-343 still holds to semi-annual reporting.
On the enterprise IT side:
- Confirm number ownership records are current and match what your provider has on file.
- Choose SIP trunks and hosted PBX arrangements from providers who commit to signing and can explain their attestation practices in plain language.
- Run test calls to major Canadian carriers and inspect the SIP headers for a valid Identity header and PASSporT token rather than assuming signing is happening.
- Track your signed call rate and attestation mix monthly, not just at renewal time, so a problem shows up in your own data before a customer complains about a blocked call.
Testing shouldn't be a one-time setup task. Carriers occasionally change infrastructure, certificates lapse, and trunk providers get acquired or migrated. A quarterly test call cycle, checking headers and logging results in a simple run book, catches drift before it turns into blocked calls and complaint tickets.
What Verified Caller ID Actually Buys You
Businesses that sign calls with strong attestation tend to see better answer rates, particularly on outbound calls to customers who've been trained by years of scam traffic to screen unknown numbers. A verified caller ID indicator on a compatible device gives a recipient a reason to trust the call before they even answer, which matters enormously for appointment confirmations, delivery notifications, and time-sensitive customer service calls.
But don't oversell what the framework does. STIR/SHAKEN confirms identity, not intent. It has no opinion on whether a call is a scam, a robocall, or a legitimate customer service outreach; that judgment still comes from carrier analytics engines and reputation scoring systems layered on top of the authentication signal. A fully verified, 'A' attestation call from a number with a poor reputation history can still get flagged or blocked.
A few practical limits worth internalizing:
- Cross-border calls routed through carriers outside the STIR/SHAKEN framework often arrive unsigned, even when your outbound leg was fully authenticated.
- Device compatibility matters. A carrier's own guidance confirms the verified checkmark only appears on compatible handsets when both the originating and terminating networks support the standard, so some of your legitimately signed calls will show no visible indicator to the recipient at all.
- Verification is typically automatic and free for eligible customers, but that doesn't mean every call you place will display it.
Why Legitimate Calls Get Mislabeled
False positives happen more than most businesses expect, and the causes are usually traceable once you know where to look. Shared numbers across a call center's outbound pool, weak attestation from a reseller that never verified your number ownership, and traffic routed through international gateways are the three most common culprits behind a legitimate call getting flagged as spam.
Fixes tend to be operational rather than technical:
- Keep your KYC documentation current with your provider so attestation stays at 'A' rather than slipping to 'B'.
- Avoid bursts of simultaneous outbound calls from a single number, a pattern that reputation systems read as robocall behavior even when the calls are legitimate customer outreach.
- Contact your carrier directly if you see a pattern of blocked or mislabeled calls rather than assuming it will resolve itself.
Pro Tip: If a specific number starts getting blocked or shows a spam label, request a traceback investigation through your carrier immediately and document the call volume, timing, and destination pattern around the incident. That documentation is what turns a vague complaint into a fixable ticket.
— James
Tracking Compliance Without Waiting for a Regulator Call
Since CRTC 2025-343 moved most TSPs off standing semi-annual reports and onto targeted requests, the practical burden shifted from filing paperwork on schedule to being ready to answer fast when the regulator actually asks. That means your own internal metrics matter more now, not less.
| Metric | Why it matters |
|---|---|
| Signed call rate | Shows what percentage of outbound traffic actually carries a valid signature |
| Attestation mix (A/B/C) | Reveals whether your numbers are documented well enough to earn full attestation |
| Block and rejection rate | Flags mislabeling problems before customers start complaining |
| Complaint volume | Tracks whether call recipients trust your caller ID over time |
Keep SIP header logs, test call records, and traceback correspondence on file. If a targeted request lands on your desk, the businesses that respond fastest are the ones who already had this data organized instead of scrambling to reconstruct it after the fact.
Getting Signing Right Starts With the Install, Not the Contract
Most attestation problems trace back to how a phone system was set up, not to some flaw in the STIR/SHAKEN framework itself. When numbers get ported sloppily, when a hosted PBX gets configured by someone who never asked about attestation policy, or when a business ends up on a shared trunk pool with no documentation trail, the signing chain breaks quietly and nobody notices until calls start getting blocked.
Some providers design and install on-site phone systems for Ontario businesses, using an approach where the system is cabled, programmed, and tested in person rather than shipped in a box with instructions to figure it out. Running on reliable infrastructure that handles many business calls daily means number documentation and trunk configuration can be done properly upfront rather than patched after a compliance complaint.
If you manage phone systems for an Ontario organization, the immediate move is straightforward: get a network check done and ask directly what attestation level your current setup is earning.
Get a Phone System That Signs Calls Correctly From Day One
You've got options for getting your Ontario business STIR/SHAKEN-ready: switch carriers and hope their support team walks you through attestation configuration, hire a generalist IT contractor unfamiliar with SIP trunking, or self-provision a hosted PBX and troubleshoot number documentation on your own. An alternative approach involves a local Ontario team that designs, cables, and configures phone systems on-site, so number ownership, trunk selection, and attestation setup are handled correctly before calls begin.
Some providers offer fixed pricing and warranties on rented phones. Multi-site operations and businesses managing remote offices benefit particularly, since consistent attestation across locations depends on centralized, documented configuration rather than each site doing its own thing. Property managers, trades and construction companies, and staffing agencies all have specific calling patterns that affect attestation risk, which is exactly the kind of detail a boxed VoIP kit won't catch. If your organization runs multiple locations, the multi-site and remote office phone system page is the right starting point. For a fully custom build, use the phone system designer to book a network and E911 check, and get a clear answer on where your current setup stands before a blocked call costs you a customer.
Sources
- Compliance and Enforcement and Telecom Decision CRTC 2025-343
- RFC 8224 — STIR: Secure Telephone Identity Revisited
- Bell — What is STIR/SHAKEN?
FAQ
What is the STIR/SHAKEN protocol?
STIR/SHAKEN is a caller ID authentication framework that uses digital certificates to verify a call's originating number is legitimate. STIR defines the technical signing process under RFC 8224, while SHAKEN governs how carriers apply it across their networks.
How do I stop getting so many spam calls in Canada?
STIR/SHAKEN reduces spoofed calls but doesn't filter spam content on its own, so pairing carrier-level call blocking features with your device's built-in screening tools gives better results than relying on authentication alone. Registering your business numbers properly with your provider also helps your own legitimate calls avoid getting caught in the same filters.
Does 662 block spam calls in Canada?
Some Canadian carriers offer short-code call filtering or blocking services, but availability and specific codes vary by provider, so check directly with your carrier for what's active on your line. STIR/SHAKEN attestation works alongside these carrier tools rather than replacing them.
Why am I suddenly getting lots of spam calls?
A sudden spike in spam calls often follows a number being exposed through a data breach, an online form, or a spoofing campaign that copied a legitimate business number to make its calls look trustworthy. STIR/SHAKEN helps terminating carriers detect when a number is being spoofed, but the surge itself usually stems from your number circulating somewhere you didn't authorize.
Does STIR/SHAKEN apply to my Ontario business's phone system?
Yes, if your calls travel over IP at any point, which almost all modern VoIP and hosted PBX systems do. The specific attestation level your calls receive depends on how well your provider has documented your number ownership, which is why working with a provider who handles the setup on-site matters more than most businesses realize until a call gets blocked.