Do-Not-Originate (DNO) Lists: How the FCC Mandate Blocks Spoofed Calls

A do-not-originate list solves a problem that sounds almost too simple to need a rule. Some phone numbers should never place an outbound call. The IRS main line only receives calls. A block of numbers a carrier was handed but never assigned to anyone can’t legitimately dial out. An invalid number that isn’t even valid under the North American Numbering Plan has no business appearing as the source of a call. Yet those are exactly the numbers robocallers spoof, because a familiar or authoritative caller ID is what gets a call answered.

A Do-Not-Originate (DNO) list is a database of numbers that should never originate a call. When a call shows up claiming to come from one of them, you know the caller ID is forged, and you can block the call before it ever rings a phone. As of December 15, 2025, the FCC no longer treats this as optional. Its DNO mandate requires every voice service provider in the call path to check calls against a reasonable DNO list and block the ones that match.

The way I think about it, DNO is the bluntest and most reliable fraud control you have. Unlike a risk score that guesses at intent, a DNO match is a fact: this number cannot legally originate a call, so this call is spoofed. This article covers what a DNO list actually contains, what the FCC’s December 2025 rule requires, where the enforcement has to happen in your network, and how a Session Border Controller (SBC) does the blocking in real time without slowing legitimate calls down.

What a Do-Not-Originate List Actually Contains

Let me take a step back and be concrete about what goes on a DNO list, because the power of the control comes entirely from how it is scoped. A DNO list is not a list of bad actors or suspected fraudsters. It is a list of numbers that, for structural reasons, cannot be a real caller. That distinction is what makes DNO blocking safe to apply automatically.

The FCC’s own description of a reasonable list points at four categories, and each one fails the “could a real person be calling from here?” test for a different reason.

• Invalid numbers are not valid under the North American Numbering Plan at all, so no phone can genuinely place a call from one. A malformed number or an unassigned area code in the calling field is a forgery on its face.
• Unallocated numbers are valid formats that the numbering administrator has never handed to any provider. Nobody holds them, so nobody can dial out from them.
• Unused numbers have been allocated to a provider but not yet assigned to a subscriber. Until they go into service, a call claiming to originate from one is almost certainly spoofed.
• Inbound-only numbers are working, assigned numbers whose owner has asked that they never originate calls. A government main line, a bank’s fraud-report hotline, or a receive-only IVR is a classic example. The subscriber opts the number into DNO treatment precisely because attackers love to spoof it.

That last category is where DNO earns its reputation. The numbers attackers most want to impersonate are exactly the trusted, authoritative, inbound-facing numbers that never call you first. Putting them on a DNO list means a spoofed “call from your bank’s fraud line” gets stopped at the network edge instead of reaching your phone with a convincing caller ID.

What the FCC DNO Mandate Requires

DNO blocking is not new as a technique. What changed in 2025 is that the FCC moved it from a permitted best practice to a requirement, and widened who has to do it. The vehicle is FCC 25-15, a Report and Order in CG Docket No. 17-59 adopted February 27, 2025 and codified in 47 CFR 64.1200(o). Enforcement began on December 15, 2025.

Who Has to Block

The most important change is scope. An earlier rule already obligated gateway providers and messaging providers to block calls likely to be illegal based on a reasonable DNO list. FCC 25-15 extends that same obligation to all voice service providers in the call path. Whether you originate the call, transit it across your network, or terminate it to the called party, if a call purports to come from a number on a reasonable DNO list, you are required to block it. There is no longer a “we’re just in the middle” exemption.

Which List to Use

The FCC deliberately did not mandate one specific DNO list. It set a standard instead: the list has to be reasonable. In practice that means accurate, scoped to the categories above, and refreshed often enough to stay effective without blocking numbers that have since been legitimately activated. The Commission also declined to fix a mandatory update frequency, expecting providers to update with “sufficient frequency” to balance effectiveness against the risk of erroneous blocking.

That flexibility is a double edge. You get to choose your data source, but you also own the “reasonable” judgment call. This is where commercial DNO datasets come in. Somos RealNumber DNO, for instance, maintains a dataset of over six billion toll-free and local numbers, which is one of the lists providers use to satisfy the reasonableness standard without having to assemble numbering data themselves.

How DNO Fits the Rest of the Robocall Rules

DNO does not replace anything you already do; it stacks with it. STIR/SHAKEN, the Robocall Mitigation Database, and traceback obligations all address caller identity and illegal traffic from different angles. DNO is the piece that handles the simplest and most certain case: numbers that cannot possibly be calling. Treat it as the floor of a layered program, not the whole program.

DNO Blocking Versus STIR/SHAKEN

People often ask whether DNO and STIR/SHAKEN are competing controls. They are not. They answer two different questions, and a serious fraud posture uses both.

STIR/SHAKEN asks, “does the originating provider vouch for this caller?” It signs the calling number and carries an attestation level so the terminating side can judge how much to trust the identity. DNO asks a blunter question: “can this number originate a call at all?” One is about trust and provenance; the other is about physical possibility. A call can carry a valid STIR/SHAKEN signature and still be spoofing a DNO-listed number if something upstream is misconfigured, and a call can be perfectly legitimate yet unsigned. Checking both closes gaps that either alone would leave open.

Question it answers	DNO blocking	STIR/SHAKEN
What it checks	Can this number legitimately originate a call?	Does the originating provider attest to this caller?
Decision type	Deterministic match	Trust signal, needs policy
False-positive risk	Very low	Depends on attestation policy
FCC status (Dec 2025)	Mandatory, all providers	Mandatory framework
Best used as	Deterministic first line	Trust layer for everything else

The practical takeaway is to run DNO as the deterministic first line and let STIR/SHAKEN verification and real-time fraud scoring handle the harder, probabilistic cases behind it.

Where DNO Enforcement Has to Happen

Knowing which numbers to block is the easy half. The harder question is where in the network the check runs, and the answer matters more than it first appears. A DNO list is only useful if it is consulted at a point that sees every call and can act before the call completes. That points straight at the edge of the network, which is where the SBC lives.

The SBC Sees Every Call at Setup

The SBC sits in the SIP signaling path as a back-to-back user agent, terminating each inbound call and re-originating it toward the destination. That position gives it two things nothing else in the network has at once: visibility into the calling number on every single call, and a decision window during call setup, before the media path is even built. A DNO check at the SBC happens while the INVITE is being processed, so a blocked call never consumes a trunk, never rings a phone, and never generates a billable minute.

Blocking During Setup Adds No Media Latency

This is the part worth being specific about. The DNO lookup runs during the signaling phase, not during the conversation. On a programmable SBC the calling number is matched against the list in milliseconds, and only calls that match are stopped. Clean calls advance normally with no perceptible delay, because the check finished before any audio started flowing. You get deterministic blocking without paying for it in call quality.

Doing It at the Edge Also Satisfies the “All Providers” Rule

Because FCC 25-15 puts the obligation on every provider in the call path, the enforcement point needs to cover originating, transit, and terminating traffic. An SBC at your network border sees all of it, which is why centralizing DNO blocking there is cleaner than trying to bolt it onto individual PBXs or softswitches. One control point, applied to every trunk, is far easier to prove reasonable to a regulator than a scatter of per-system settings.

How ProSBC Enforces DNO in Practice

ProSBC handles DNO through two complementary mechanisms, and which one you reach for depends on whether you are matching a static set of numbers or subscribing to a large, maintained dataset.

For local and per-trunk control, the BlackWhiteListing module applies allow and block lists at global or per-NAP scope using longest-prefix matching. That covers inbound-only numbers a customer asks you to protect and any number ranges you maintain yourself. For the large regulatory datasets, the dedicated Do-Not-Originate module is powered by Somos RealNumber, so you consult the six-billion-number dataset in real time rather than trying to load and refresh it locally.

Both approaches run inside ProSBC’s routing engine during call setup, which is the same place its STIR/SHAKEN and fraud-scoring integrations run. That matters operationally: you are not stringing together separate boxes for DNO, attestation, and fraud scoring. A single call can hit a DNO check, a STIR/SHAKEN verification, and a fraud-score query in one pass through the routing script, and the routing decision reflects all of them before the call advances.

Frequently Asked Questions

Conclusion

DNO blocking is the rare fraud control that is both simple and certain. It does not guess at intent; it acts on a structural fact that a number cannot originate a call, which is why the false-positive risk is so low and why the FCC was willing to make it mandatory for everyone in the call path. As of December 15, 2025, checking calls against a reasonable DNO list is a live compliance obligation, not a nice-to-have.

The practical next step is to decide where you enforce it and how you source your list. Enforce at the SBC, because that is the one point that sees every call and can block during setup without touching call quality. Source from a reasonable, well-maintained dataset so your “reasonable list” judgment holds up. Then let DNO be the deterministic first line, with STIR/SHAKEN and fraud scoring layered behind it for the cases DNO can’t decide on its own.