CFCA's DNO+ would have enterprises declare which providers may sign for their numbers

The CFCA Trust & Transparency Working Group published a framework for DNO+ on September 3, with the full framework document behind it. I co-chair that working group, so this is a note on my own group’s output rather than an outside read of it.

Classic DNO marks numbers that should never originate calls. DNO+ adds the inverse case: a number that originates only through the providers its holder has authorized. The evaluation reuses the DNO scrub providers already run and adds one comparison — where a number is not on the DNO list, the provider checks whether the signing OSP’s Service Provider Code appears in that number’s DNO+ declaration. A match gives the Attestation “A” claim external grounding. No match, and the call is treated as unauthorized regardless of the attestation level the signer asserted.

The declarations are published by the right-to-use holder against its own numbering inventory: SPCs scoped to a single number, a range, a toll-free number or an NPA-NXX block, identified by OCN or RespOrgID. The framework’s stated aim is that this rolls up into the same shape as a DNO list, so existing list providers extend their distribution rather than anyone standing up a registry, and it creates no new numbering authority. Because the signing SPC travels in the SHAKEN PASSporT, a mismatch is readable at any point in the call path rather than only at origination.

The framework leaves it to each provider to decide how to use the signal and models adoption on DNO’s own spread, which understates the hook already in the rules. Since December 15, 2025, 47 CFR § 64.1200(o) has required every voice service provider to block calls purporting to originate from a number on a reasonable do-not-originate list, extending an obligation that previously reached only gateway and messaging providers. The Commission declined to define “reasonable,” saying only that such a list could include “invalid, unallocated, and unused numbers, as well as numbers for which the subscriber has requested blocking.” That last category is the one a DNO+ declaration refines — from never originate, to originate only through these.

Adding DNO+ to that obligation is what I want to see, and it is the shortest path from a published declaration to a spoofed call that does not complete. It arrives a day after TransNexus reported that the ten SHAKEN-authorized providers signing the most robocalls apply A-level attestation to 71% of their traffic.

The obligation exists and the protection for carrying it out does not. The Commission refused to adopt a safe harbor for blocking on a reasonable DNO list, on the reasoning that it could not determine what liability a provider would face for doing so — the same safe-harbor question the KYUP record is working through, and the Regulatory Watch dispatches carry that filing detail.

Underneath both sits right-to-use. A declaration is worth what the record of who holds the number is worth: settled for toll-free, where RespOrgID already answers it, and thin for geographic numbers, where establishing right-to-use is itself an open proceeding.