Reader setup
Before you evaluate
Use this to set expectations, limits and implementation boundaries before changing anything.
- A named jurisdiction, because the rules below differ by country and by state or province
- Legal/compliance ownership
- An inactive synthetic test list
- What you will prove
- A documented technical-control map and external-test plan.
- Safety boundary
- This is not legal advice and does not authorize calling.
Reader path
How to use this article
- Use it when: You are designing a change and want reliable limits before implementation.
- Expected result: Separate what is known, unknown, and unsafe before you execute.
- Start here: Use it as an evidence review before changing architecture, security, or reporting behavior.
Use controls for their actual purpose
Fast answer: a do-not-call (DNC) filter, external DNC.com batch scrubbing and optional STIR/SHAKEN caller-identity signaling solve different technical problems. None alone determines whether a call is lawful, permitted by policy, or accepted by a carrier.
STIR/SHAKEN stands for Secure Telephone Identity Revisited and Signature-based Handling of Asserted information using toKENs. In practice it means the carrier you hand a call to — the phone company carrying it onward — cryptographically signs the caller ID, and the carrier receiving it checks that signature. The signature carries an attestation level: A, or full attestation, means your carrier knows you and confirmed you may use that number; B, or partial, means it knows you but cannot vouch for the number; C, or gateway, means it can only say where the call entered its network. Lower attestation makes a call more likely to be labeled or blocked before it rings.
An API is an application programming interface; an attestation is a provider's identity-signaling result. This article is technical guidance, not legal advice. United States references below are labeled U.S.; other countries, states/provinces and industry rules can impose different requirements, so obtain advice from the responsible legal/compliance owner before changing calling practice.
Terms are defined in vicidial-terminology-for-complete-beginners.
- Prerequisite: identify the jurisdiction, campaign purpose and responsible legal/compliance owner.
- Non-goal: do not enable a scrub or signing integration, or make a legal conclusion, from this article.
- Identify manual, auto, API and callback call paths.
- Obtain legal/compliance and carrier approval criteria before production use.
Visual walkthrough
Follow three real demo screens
Captured on an isolated VICIdial demo: Administration screens on September 24, 2026, and the idle Agent screen on August 11, 2026. Each caption states its own capture time, and every sanitized image helps you recognize a related screen; none proves that this article's call, command, or result occurred.Open the Filters workspace
Read the shared DNC status definitions
Find the campaign's Lead Filter field
Map every dialing path to an eligibility control
Internal system/campaign DNC and phone-filter groups are application controls that must be checked consistently across outbound, manual, API and callback workflows. Call-time, timezone, consent/permission evidence and organization policy are separate decisions and should not be inferred from a status value.
Use this control map with synthetic cases, not calling data. OWNER names the accountable function, and STOP means escalation before any dialing change. The documented DNC.com integration performs a batch filter after list loading rather than a per-dial lookup, so define when a newly changed eligibility record becomes effective and what happens when the external service is unavailable.
- Use an inactive test list and synthetic records first.
- Back up affected lead status before batch work.
- Measure sanitized input, changed, rejected and exception counts.
PATH: manual / CONTROL: DNC + policy review / OWNER: compliancePATH: auto / CONTROL: DNC + call-time / OWNER: operationsPATH: callback / CONTROL: DNC + callback policy / OWNER: operationsSTOP: any path has no approved controlThis sample is a template or reading aid, not a terminal command. There is no output to show.
- Before you run it
- Complete before any test; PATH is a workflow label and OWNER is a role, not a person.
- Success looks like
- Every path has an approved control and accountable owner.
- Stop if
- Stop and seek compliance direction for any unmapped path.
Treat signing as a carrier-dependent integration
VICIdial's optional TILTX path for outbound identity attestation and signing (TILTX_SHAKEN_API.txt) uses TILTX, a third-party call-authentication service, and AGI, the Asterisk Gateway Interface, the mechanism Asterisk uses to hand a call out to an external script mid-flow; the reference doc says it requires VICIdial SVN revision 3449 or later on every server in the cluster. It depends on vendor availability, verified identity/certificate arrangements, trusted headers, carrier acceptance and bounded latency.
Use this decision record before a dedicated synthetic-route test. FAIL-CLOSED means the agreed behavior is to prevent the call when the integration fails; FAIL-OPEN means the agreed behavior is to continue. Neither selection is a legal conclusion, and an undecided setting is a stop condition.
In the U.S., the FCC's stated purpose for call authentication is a framework meant to help verify caller-ID information; confirm the current text yourself, since an automated check of the FCC's page returned HTTP 403 (blocked) during this research. Whatever it says, it does not make an illegal call permissible, guarantee display treatment, prevent all blocking or establish the right to use a calling number.
- Confirm supported revision, vendor contract and carrier route.
- Prevent untrusted identity-header injection.
- Define timeout, retry and explicit fail-open or fail-closed behavior with owners.
ROUTE: approved synthetic routeTIMEOUT: owner-approved valueFAILURE MODE: FAIL-CLOSED or FAIL-OPENEVIDENCE: sanitized response class + timingSTOP: carrier, provider, or legal owner has not approvedThis sample is a template or reading aid, not a terminal command. There is no output to show.
- Before you run it
- Complete with roles and an approved synthetic route; do not enter a real number, header, token or provider secret.
- Success looks like
- All owners approve one explicit behavior and evidence plan.
- Stop if
- Stop integration testing when the failure behavior or route approval is unresolved.
Test a dedicated route before policy rollout
Run controlled calls over a dedicated, approved route and capture only sanitized technical outcomes such as call setup timing, response class and carrier acceptance. Test successful signing, vendor timeout, malformed response, rejected identity and carrier fallback without exposing customer numbers, recordings or headers.
Equivalent external tests remain required: the provider must confirm its current interface and limits, the carrier must confirm acceptance behavior, and counsel must review the actual jurisdictions and campaign practices. Local source evidence cannot substitute for any of those tests.
- Keep the test population isolated from live campaigns.
- Set stop thresholds for latency and error rate before testing.
- Review results independently with telecom and compliance owners.
Make changes reversible and evidence-based
Stop a scrub or signing rollout if result counts are unexplained, controls differ across call paths, the vendor response is ambiguous, or carrier behavior changes unexpectedly. Do not delete DNC history or override status broadly to make a report look clean.
Rollback means disabling or reverting the approved integration/configuration change and restoring from the tested lead-state backup where authorized. Preserve non-sensitive configuration versions, timestamps and aggregate observations for the post-change review.
- Reconcile eligible population before re-enabling dialing.
- Retest outbound, manual and callback paths after rollback.
- Schedule periodic review because law, carrier policy and provider behavior change.
Evidence ledger
Verification basis
- VICIdial documents DNC.com and TILTX STIR/SHAKEN as optional external integrations; international DNC was disabled in this lab at the time of writing.
- No legal conclusion, carrier certification, attestation result or external scrub test was performed for this article.
- An automated check of the FCC's Call Authentication page returned HTTP 403 (blocked) on September 23, 2026; it is cited below as background only, not as a directly retrieved primary source. The FTC page cited below loaded normally the same day.
Primary references
Sources
- VICIdial DNC.com integrationVICIdial · accessed September 23, 2026
- VICIdial TILTX SHAKEN APIVICIdial · accessed September 23, 2026
- Call AuthenticationFederal Communications Commission · accessed Blocked (HTTP 403) on September 23, 2026
- Complying with the Telemarketing Sales RuleFederal Trade Commission · accessed September 23, 2026