Quick answer: Do-Not-Originate (DNO) is a block list applied to the calling number, not the called number. Where Do-Not-Call (DNC) opt-outs filter destinations you must not reach, DNO flags caller IDs that must never originate a call — government agency lines, inbound-only toll-free ranges, unallocated number blocks — because a fraudster's favorite trick is presenting exactly those numbers to look trustworthy. On Devotel Orbit, a DNO guard rejects an outbound call at dispatch time with a 422 VOICE_DNO_BLOCKED the moment the resolved caller ID matches a curated entry. This explainer covers what DNO is, the legal backdrop that makes it a STIR/SHAKEN-era necessity, how the matching works, and how Orbit's tenant-owned curation model puts you in control of your own list.
The shipped guard and its error semantics live in the troubleshooting page for voice destination blocks. This post is the conceptual companion: what DNO is, and why every outbound program should run one.
What Do-Not-Originate actually filters
DNC and DNO answer two different questions about the same call. DNC asks "was this destination opted out?" — a recipient-protection check. DNO asks "is this caller ID even a number anyone may legitimately present?" — an origin-protection check. Spoofing survives the first filter because a fabricated caller ID does nothing to the destination's opt-out status; the call reaches the recipient looking exactly as trustworthy as the spoofed number suggests.
The categories of number that belong on a DNO list are the ones a legitimate originator cannot own:
| Category | Why no legitimate caller can present it |
|---|---|
| Government agency lines (IRS, SSA, law enforcement) | Fraud impersonation is the classic spoofing payload; the number is inbound-only by policy |
| Inbound-only toll-free ranges | The number is registered to terminate inbound calls, never to originate them |
| Unallocated NANP ranges | If no carrier has assigned the block, any call presenting it is fabrication |
| Inbound-only service and emergency lines | Same policy: the line exists to receive, not to originate |
A caller ID from one of those categories failing to pass a DNO guard is not a nuisance filter tripping — it is proof the origin was never legitimate, and the call never rings.
The legal backdrop: TRACED Act and traceback pressure
Presenting an invalid, unallocated, or inbound-only caller ID is illegal spoofing under the TRACED Act and FCC rules (47 CFR § 64.1604), and it is the pattern that most often drives a carrier-initiated STIR/SHAKEN traceback investigation against an originator. Blocks at the dial path are cheaper than blocks at the regulatory path: a 422 you fix in your account settings is quiet; an FCC inquiry about spoofed originating traffic is not. DNO is the origination-side complement to the recipient-side DNC controls — the pair covers both directions of the compliance exposure a voice program carries.
Where the guard runs on the Orbit dial path
Devotel Orbit evaluates outbound voice through a fixed pre-send gate chain before any SIP leaves the platform. The DNO guard runs after your caller ID is resolved and validated as an active number, alongside the fraud-velocity guard, and before the trunk allow-list and per-country rate-window checks. A match short-circuits the whole chain: the API returns 422 with code VOICE_DNO_BLOCKED, the response body names the matched DNO prefix, and no media, billing hold, or SIP INVITE is ever attempted. When a call does pass, routing is unchanged — the guard is advisory-only on the dial path and never alters how an accepted call is carried.
That position in the chain matters for triage: a rejection code tells you the exact gate that fired, without touching trunk, codec, or carrier configuration.
How matching works: one prefix semantic, two granularities
Orbit's DNO list matches on prefix rather than exact equality, because the threat classes come in two shapes. A full E.164 entry such as +18005551212 blocks exactly that one number — a specific spoofed line you know about. A shorter entry such as +1800555 blocks the entire range — an unallocated block you want closed as a class. The same startsWith match covers both, and normalization strips everything that is not a digit or a leading + before comparing, so access-prefixed or whitespace-padded input cannot sneak past the list.
Worked example on a populated list:
| Presented caller ID | DNO entry | Result |
|---|---|---|
+18005550101 | +1800555 | blocked — range prefix |
+18005551212 | +18005551212 | blocked — exact entry |
+121255501xx (a DID you own) | neither | accepted |
Curating your list: the tenant-owned override model
There is no universally safe default DNO set — a platform-shipped block that included a range your business legitimately owns would be worse than an absent guard. Orbit ships an empty platform baseline and gives every organization a tenant-level override with three modes, mirroring the blocked-prefix model the compliance team already uses:
- extend — add entries to the platform baseline (the default shape for most lists).
- replace — use exactly and only your own entry set.
- subtract — remove specific baseline entries when your own DIDs collide with one.
The override lives in your voice settings, scoped to the whole organization. Because the default list is empty, existing tenants see no behavior change until they opt in and curate — the guard starts out as a cheap no-op. And if the per-organization lookup ever blips, the guard falls back to the platform baseline instead of black-holing your outbound traffic — a fail-open posture on a gate you own, which is the same asymmetric posture the rest of the dial-path tenant-owned gates take.
DNO alongside DNC, CNAM, and the trunk allow-list
The voice-compliance vocabulary has four caller-protection controls that sound related but guard different surfaces:
- DNC filters your destinations by recipient opt-out status.
- DNO filters your caller IDs by origin legitimacy.
- CNAM names which business owns an inbound number — a reception-side identity annotation.
- Trunk allow-lists restrict which caller IDs a customer SIP trunk may present — a provisioning control.
They cooperate rather than overlap: a spoofed caller ID that slips through a bare trunk allow-list can still die on the DNO list, and a clean caller ID still respects every recipient's DNC opt-out. Read them as complementary, not competing.
Frequently asked questions
What is a Do-Not-Originate list?
A Do-Not-Originate (DNO) list holds the numbers that must never appear as a calling-party number — government agency lines, inbound-only toll-free ranges, unallocated number blocks. It is the origin-side counterpart to Do-Not-Call: one filters recipients, the other filters fabricated caller IDs.
Why do I need DNO if I already run DNC suppression?
DNC protects recipients; DNO protects the originating identity. A spoofed caller ID survives DNC checks because fabricating the from-number does nothing to the destination's opt-out status. DNO closes that gap at the origination point.
My outbound call was blocked with VOICE_DNO_BLOCKED — what happened?
The caller ID you presented matched a DNO entry or prefix — typically because the number is inbound-only, belongs to an unallocated range, or is a government line. Compare the rejected number against your organization's DID list, and present a verified number you own. If you deliberately own a number that collides with a baseline entry, use the subtract override mode to carve the exception.
Is the DNO guard on by default?
No. The platform ships an empty baseline because there is no universally safe default set, and each organization opts in by curating its own entries with an extend / replace / subtract override in voice settings. Until you add entries, the guard is a cheap no-op.
Does a DNO block count against my per-country rate window?
No. The DNO guard runs before the rate-window check and short-circuits it, so a blocked origination never reaches the window at all.
The takeaway
DNO is the missing half of the caller-protection pair. DNC keeps unwanted calls from reaching recipients; DNO keeps fabricated identities from originating the call in the first place. On Devotel Orbit the guard is tenant-owned, prefix-matched, fail-open on lookup errors, and silent until you curate — and a VOICE_DNO_BLOCKED rejection names the exact prefix that fired, so fixing it is a settings change, not an escalation. For the operational runbook, see the voice destination blocks troubleshooting page, and for the full pre-send gate order see the voice pre-send gate chain concept page.