What STIR/SHAKEN is, and what it means for you
STIR/SHAKEN is how phone companies vouch for caller ID. When you place a call, your phone company can add a digital signature that vouches for the number you're calling from. It also says how sure the company is that the number is yours. A phone company further along can check that signature before the call reaches the person you're calling.
In Canada the CRTC has required phone companies to use it on internet-based (IP) calls since November 30, 2021, to make spoofed caller ID harder to get away with. But a call can cross an older network that can't carry the signature, or a carrier that signs it again. So whether a call shows up as verified depends on every network it passes through. This page shows you what actually arrives.
Test 1: Call us and see what your call carried
- From the phone you want to test, call 780-306-1177 or 780-440-2502. Any number in Canada or the US can call.
- A short recorded message answers and then hangs up. That's all the call needs to do.
- Wait a minute or two, then enter the date of the call and the number you called from in the form below.
- We show you what arrived: every signature the call carried, its attestation level, who signed it, whether it checks out, and and the SIP headers we received.
Test 2: We call you with a signed call
- Enter your phone number below and confirm you want a test call.
- We call you from 780-306-1177 within about a minute. We sign the call ourselves at attestation level A.
- Before you answer, look at your phone. Some phones and carriers show a check mark or the word Verified next to a call they verified.
- Answer if you like. A short recorded message explains the test and hangs up. Your result here shows what we sent.
Reading your result
- A
- Full attestation. The phone company that signed the call knows the customer and knows they're allowed to use the calling number. This is the strongest level.
- B
- Partial attestation. The signing company knows the customer the call came from, but couldn't confirm they're allowed to use that calling number. This can happen when a business phone system sends a number the signing company can't confirm.
- C
- Gateway attestation. The signing company only knows where it received the call, usually from another network. It says nothing about who placed the call.
- No signature
- No signature arrived with the call. Either it was never signed, or the signature didn't make it through every network on the way. Calls still arrive this way for ordinary reasons, so it doesn't mean anything is wrong with your line.
Who signed it
Every signature points to a certificate that names the phone company that signed it, along with its Service Provider Code (SPC). If the signer shown here isn't your own phone company, another company involved in the call signed it. The result alone may not tell you why: your phone company may not have signed it, or another company signed it again along the way.
Verified
We check the signature against its certificate, and the certificate against the Canadian STIR/SHAKEN trust list. A pass means the certificate comes from a certificate authority the Canadian system trusts, and nothing in the signed fields was changed after signing. It doesn't tell you whether the call itself was wanted or legitimate, only who vouched for it.
Questions
What's STIR/SHAKEN?
It's a set of standards for signing caller ID. STIR stands for Secure Telephone Identity Revisited, and SHAKEN for Signature-based Handling of Asserted information using toKENs. When a call starts, the caller's phone company can attach a signed token to it, called a PASSporT. The token names the calling and called numbers, the time, and an attestation level: A, B or C. The phone company signs it with a certificate from a certificate authority that the Canadian Secure Token Governance Authority trusts. The phone company receiving the call can then check who signed it and that nothing in it was changed.
What does it mean for Canadians, and what doesn't it do?
The CRTC requires Canadian phone companies to use STIR/SHAKEN to authenticate and verify caller ID on internet-based (IP) voice calls, as a condition of offering phone service. That's Telecom Decision CRTC 2021-123, in effect since November 30, 2021. The goal is to give people a way to judge how far to trust a call, and to make spoofed caller ID harder to use. It doesn't block calls. The original signature only reaches you if every network on the way passes it on, and an older non-IP network can't. And how a phone shows the result is up to the phone and the carrier, so many phones show nothing at all. A verified call tells you who vouched for the number, not that the call is wanted.
My phone company should know me. Why did my call show C, or no signature at all?
Usually because of what happens between networks. While building this tool, we saw calls we signed A arrive at some numbers re-signed C by another carrier. Some calls arrive with no signature at all. The signer shown in your result tells you who signed the signature that arrived, and if more than one arrived, we show each one.
Your test call never rang my phone. Why?
Usually because something on your line handled it before the phone rang. Your carrier's spam screening, a phone setting that silences unknown callers, Do Not Disturb, a call-blocking app or voicemail can all do this. The result after a test call shows what your phone company did with it. Save 780-306-1177 in your contacts and ask for another call.
Is this free?
Yes. There's no charge and no sign-up. Calling our test numbers costs you whatever a normal call to an Edmonton number costs on your plan.
What do you keep, and for how long?
We keep the call record, including the SIP headers (the technical details networks exchange to set up a call), for 90 days. We only show it to someone who enters the matching date and calling number, and we don't share it with anyone.
Can I test my business line?
Yes. Call one of the test numbers from the business line and look up the number your call display sends. If your phone system sends a main number instead of your direct line, that's the number to enter. You can also have us call a business number, as long as someone can answer it.
Why did you build this?
We run our own phone switches, and we've started signing our customers' calls with our own certificate. We wanted to see what actually arrives at the other end, not what's supposed to, and we wanted a simple public way to check. So we built one and opened it up.
Who runs this
The Internet Centre has been in Edmonton since 1993, as Alberta's first ISP. We're Canadian owned and operated, and we run our own VoIP switch out of our own Edmonton data centre. We provide SIP trunks, hosted PBX and 3CX, phone numbers and porting to businesses across Canada.
We're a member of the Canadian Secure Token Governance Authority and hold our own STIR/SHAKEN certificate, SPC 851J, and we've started using it to sign our customers' calls. If you want a phone provider that can tell you how your calls are handled, and will pick up the phone when you ask, talk to us.