Caller ID was never authenticated. The number shown on a ringing phone is a value the originating side put in a field, and for most of the history of the telephone network nothing downstream could check whether it had any right to it. STIR/SHAKEN is the framework that adds a signature to that field so the far end can.
The part people meet in practice is not the cryptography. It is a single letter, A, B or C, and it is widely misread as a grade.
What does STIR/SHAKEN actually put on a call?
A signed token, carried in the SIP Identity header, saying who is vouching for the call and how much they are vouching for.
The token is a Personal Assertion Token (PASSporT), and the SHAKEN extension to it is specified in RFC 8588, an IETF Standards Track document from May 2019. It adds two claims to the base token. Secure Telephone Identity (STI) is the work that adds authenticated caller identity to SIP, and the first claim is the one you will see:
This provides three levels of attestation: a full attestation when the service provider can fully attest to the calling identity, a partial attestation when the service provider originated a telephone call but cannot fully attest to the calling identity, and a gateway attestation, which is the lowest level of attestation and represents the service provider receiving a call from a telephone gateway that does not support PASSporT or STI.
The claim itself is a single character. RFC 8588 section 4:
The "attest" claim can be one of the following three values: 'A', 'B', or 'C'. These values correspond to 'Full Attestation', 'Partial Attestation', and 'Gateway Attestation', respectively.
RFC 8588 delegates the definitions: "See [ATIS-1000074] for the definitions of these three levels of attestation". That document is published by the Alliance for Telecommunications Industry Solutions (ATIS) rather than by the IETF and is not free to read. The normative line between an A and a B therefore lives behind a paywall, which is part of why the levels are so consistently described second-hand.
What do A, B and C mean?
Three different statements about the relationship between the signing provider and the caller.
The Federal Communications Commission (FCC) gives a public account in its Second Report and Order on caller ID authentication, published at 85 FR 73360 on 17 November 2020. It sets out each level in the regulator's own words:
- A: "A provider assigns an A-level attestation when it is the entry point of the call onto the IP network, it can confirm the identity of the subscriber making the call, and the subscriber is using its associated telephone number."
- B: "A provider uses a B-level attestation to indicate that it is the entry point of the call onto the IP network and can confirm the identity of the subscriber but not the telephone number."
- C: "A provider uses a C-level attestation when it is the point of entry to the IP network for a call that originated elsewhere but has no relationship with the initiator of a call, such as when a provider is acting as an international gateway."
The three levels turn on whether the signing provider knows who you are and whether it knows that the number is yours. Both gives an A, the first alone gives a B, and neither gives a C, because at C the provider is a doorway rather than an origin.
That is why the level is not a rating. A perfectly legitimate call can carry a B because the caller presents a number the provider did not issue and has no way to confirm, and a nuisance call can carry an A because the entity making it is a known customer using its own number. The letter describes the provider's evidence, not the call's intent.
Who decides whether I get an A?
The provider that signs the call, using a test it defines itself.
The same FCC order says each provider defines its own test:
The method or process a provider uses to determine the legitimacy of the caller's use of a telephone number is specific to each provider. As a result, a provider's reputation is tied to the rigor of its evaluation process.
So there is no external standard you can satisfy to be entitled to an A, and no setting that grants one. There is a provider deciding whether it has established two things about you, and carrying the reputational cost of getting that wrong. The practical version of the question is not "how do I get an A" but "what has my provider established about me and about this number", and the answer to the second half is usually caller ID verification. Caller IDs covers registering a number and proving control of it, which is the step that changes what can be asserted about you.
Numbers you were issued by the provider carrying the call sit in a different position from numbers you own elsewhere and present through it. Bird's own caller ID guide makes the same point from the other side, listing anti-spoofing frameworks among the reasons a number you procured somewhere else may not survive to the far end.
Does an A mean my call gets through?
No. The standards treat attestation as an input to somebody else's decision.
The FCC order says what the levels are for:
The STIR/SHAKEN standards envision these various attestation levels as information that can facilitate traceback and to enhance the spam identification solutions that terminating voice service providers enable for their customers.
Two consequences follow. Traceback is the retrospective use: the second SHAKEN claim is an origination identifier, which exists so an investigator can walk an illegal call back to where it entered the network. Spam identification is the live use, and it is a system run by the receiving carrier and its analytics partner, which takes attestation as one signal among several. A signed A-level call can still be labelled, and why is my call labelled spam likely covers who applies the label and what recourse exists.
Why did the attestation not arrive?
Because the header does not survive every route.
The FCC's order states the mechanism plainly: "if a call is routed at any point over an interconnection point or intermediate provider network that does not support the transmission of SIP calls, the Identity header will be lost." A call can be signed correctly at origin and arrive at the far end carrying nothing to verify, because a leg in between was not SIP.
The same order notes that the terminating provider's own reach matters as much as yours: it can act on authentication information only where it can verify it, and where the header is gone there is nothing to act on. So an unsigned call at the far end is not evidence that the originating provider failed to sign, and the path between the two is not something either end fully controls.
Attestation is a strong signal when it survives and silent when it does not, so treat it as one part of getting answered rather than the mechanism that delivers it.
In short
The level describes the provider's knowledge, not the call's quality.
A, B and C record how much the signing provider could vouch for: the caller and the number, the caller alone, or neither because the call arrived from elsewhere.
The bar for an A is the provider's own.
The FCC says the method for deciding a caller may use a number is specific to each provider, and ties that provider's reputation to how rigorous it is.
An attestation is an input to a label, not a verdict.
The standards treat the levels as material for traceback and for the spam identification the receiving carrier runs. Nothing about it decides what a handset shows.
The signature can be lost before it arrives.
A call routed over a network that does not carry SIP loses the Identity header, so a signed call can reach the far end with nothing to verify.