SIP 403 Forbidden: Why a Trunk Refuses a Call

What 403 means (general SIP)

403 Forbidden means the server understood the request and refuses to fulfil it. Unlike 401/407, re-sending credentials will not help. On a termination trunk it almost always reflects a policy decision about who you are, where you are calling or what you are presenting.

Common causes

• Source IP not approved on an IP-authenticated trunk (new server, changed NAT address, failover node).
• Destination or prefix not enabled for the account or route type.
• Caller ID rejected because it is empty, malformed or not permitted for that route or destination.
• Account suspended, out of balance or over a configured spend or fraud threshold.
• Calls sent to the wrong trunk/host for the service that was actually provisioned.

How to diagnose

• Check the Reason or Warning header in the 403 response — many carriers include a short explanation.
• Confirm the public source IP of the failing call (not the private address of the dialer).
• Test one known-enabled destination: if that works, the issue is destination or route specific.
• Check that the caller ID is in full international (E.164) format if the route expects it.

At CallCenterBoost

Approved IP addresses, enabled destinations and service status are managed per SIP service and visible in the client portal. A new or changed source IP must be submitted and approved before it is accepted. If a 403 persists, open a VoIP Route ticket with the destination prefix, the source IP and timestamp.