6 min read

Published

STIR/SHAKEN, CNAM, and Why Nobody Answers Your AI's Calls

Your agent can be flawless and still show up as Spam Likely. What I learned about caller identity and number reputation running outbound voice agents.

Here is a failure nobody designs for. You build a good outbound voice agent. Latency is tight, turn-taking is smooth, the script converts when someone actually talks to it. And your answer rate is terrible, because every call lands on the other person’s screen as “Spam Likely.”

The best conversation in the world loses to a call that never gets picked up.

Building the telephony layer for Spyne’s voice agents across Twilio, Vonage and Telnyx taught me that outbound calling is two products. One is the conversation. The other is the identity of the call itself, and it is decided before anyone hears a word. This post is about the second one: the STIR/SHAKEN and CNAM alphabet soup, carrier reputation, and what you can actually do about any of it.

Who is judging your calls

In the US, whether your call shows up as your business name, a bare number, or a spam warning is decided by a loose federation you mostly cannot see. The carrier that originates your call and signs it. The carrier that delivers it. And third-party analytics engines the big carriers rely on to score calls, looking at things like volume and velocity, how often calls get answered, how long they last, how often people complain, and how long your numbers have been behaving.

The mental model that took me longest to accept: there is no place to get approved. Your call’s presentation is a probabilistic verdict, per carrier, per call, shaped by everything your numbers have done recently. You do not pass this once. You maintain a reputation inside it, continuously, forever.

What STIR/SHAKEN does, and what it does not

STIR/SHAKEN is a framework for authenticating caller identity on supported IP call paths. The originating carrier signs each call with an attestation level. A means “we know this customer and they are authorized to use this number.” B means “we know the customer but cannot fully vouch for the number.” C means “this call entered our network, that is all we know.”

Two things worth internalising.

It authenticates. It does not endorse. Full A-attestation means the signing provider asserts that it knows the caller and their right to use that number; it is not an absolute guarantee about the entire call path. It does not mean your call is wanted. A spammer dialling from numbers they legitimately bought gets A-attestation too. So attestation is hygiene you must have, not a cure for spam labels. I have seen teams get A-attestation sorted and then be baffled that nothing changed.

Your attestation depends on your provider relationship. Verify the attestation on your actual routes. Using numbers from the originating provider can simplify verification, but onboarding and number authorization still matter. Bring-your-own-number and reseller arrangements need explicit verification too; they do not automatically imply a lower attestation.

CNAM is not what people think

Traditional US CNAM is generally a terminating-side name lookup, distinct from a SIP display name or branded-calling identity. The terminating carrier queries a database of its choosing, with caching and inconsistency to match. You register a name with your provider, and what actually displays varies by carrier and can lag your changes by days.

It helps. Register it everywhere you can. But treat it as best effort, not as identity. The newer branded-calling programs, where a verified name, logo and call reason go through the carriers, are the stronger version of this, and worth evaluating as they mature, at a real per-call price.

Reputation is the part you actually control

Since there is no switch to flip, the work is operational. What has mattered in practice:

Register your numbers and your traffic through the appropriate business or provider program. The Free Caller Registry sends registration data to First Orion, Hiya and TNS. Its terms restrict submissions to businesses calling on their own behalf; a platform registering client numbers must contact the providers directly. Registration does not guarantee label removal and does not set CNAM.

Ramp legitimate traffic gradually so you can observe complaints, failures and answer rates before expanding. There is no published universal “safe calls per number” threshold, and a warm-up schedule does not make unwanted traffic acceptable.

Do not churn numbers to dodge labels. Rotating through numbers as they get flagged is called snowshoeing. It can spread a reputation problem across the pool while leaving the cause untouched. If a number earns a label from bad traffic patterns, the fix is the traffic pattern.

Make your patterns look like your intent. Short calls, high unanswered ratios and rapid redials are useful warning signs to investigate. Analytics providers do not publish a universal scoring formula, so treat these as operational signals rather than known scoring weights. This is where the AI layer and the identity layer meet. Good answering-machine detection, retry schedules with real backoff, and honouring do-not-call and banned-number lists are reputation features, not just courtesy. We filter banned numbers before they ever reach a dialer for precisely this reason.

Watch how you display, from outside. Do not rely on receiving a notification when a carrier starts labeling you. Test-dial your own numbers on real handsets across carriers, or use a monitoring service, and treat answer rate by number and by carrier as a production metric. A sudden per-carrier drop is a reason to investigate labeling, routing failures and changes in the audience or calling schedule.

Local presence cuts both ways. Matching the callee’s area code may affect answer rates, but that needs testing against your audience and should not imply a local presence the business does not have. Doing it with a rotating pool of barely-used numbers recreates the churn signature from three paragraphs ago. If you use local presence, every number in the pool still needs registration, warm-up and clean traffic.

The compliance floor

For US calling, the FCC’s 2024 declaratory ruling confirms that AI-generated voices fall within the TCPA’s artificial-or-prerecorded-voice restrictions. That does not make every AI call unlawful; applicable consent, identification and exemption rules depend on the call. Requirements also vary by jurisdiction and use case.

Have the applicable rules reviewed for the traffic you actually send, then enforce the resulting policy at dial time: consent scope and revocation, required identification, recipient-local calling hours and suppression lists. Record which policy allowed the attempt. A reputation registration is not permission to call.

Diagnose the layer before changing it

SymptomFirst checkWhat it does not establish
Wrong or missing business nameCNAM registration and display on the receiving carrierThat the call has poor attestation
Low or missing attestationOriginating provider onboarding, number authorization and the actual routeThat changing the display name will fix it
Spam warning with A-attestationComplaints, registration status and traffic patternsThat authentication has failed
Sudden answer-rate drop on one carrierTest calls, delivery failures and comparable traffic cohortsThat a spam label is the only possible cause

The takeaway

Teams building voice AI obsess over the milliseconds after a call connects and ignore the machinery that decides whether it connects at all. Answer rate is a product metric with an infrastructure supply chain behind it: attestation from your provider relationships, display from registration, and above all reputation from the aggregate behavior of your own dialer.

The agent gets the demo. The identity layer gets the answer rate.

Written by

Software Engineer II at Spyne. I build production voice agents, telephony infrastructure, and developer tools, and contribute to the LiveKit Agents SDK.

Experience and open-source contributions →
Answering-Machine Detection Is Turn-Taking's Evil TwinBefore a voice agent can decide when to speak, it has to decide whether anyone is there. Why AMD is hard, and why you cannot test it by calling your own phone.Sep 2026One API, Many Carriers: Designing a Provider-Neutral Telephony LayerProduct code should talk to a capability, not a vendor SDK. Lessons from running Twilio, Vonage and Telnyx behind one interface.Sep 2026Migrating Production Voice Agents from Vapi to LiveKitWe ran dealership voice agents on Vapi and now run them on LiveKit. What we did before the migration so it would not become a rewrite, and what it did to cost.Sep 2026
Continue exploringWriting indexAll writing.

Built for

The systems behind this post