# Outbound Calling & Caller ID

Outbound calls placed through a trunk are validated before they reach the phone network. Cloud Voice checks the caller ID your equipment presents, enforces per-trunk international calling rules, and signs the call with [STIR/SHAKEN](/sip/stir-shaken/). This protects your numbers from being spoofed, and protects the reputation of the numbers you legitimately use.

## Dialing format

Dial North American destinations as 10 digits, with or without a leading `1` or `+1`, Cloud Voice normalizes the number to E.164 before routing. Calls to numbers that don't parse as a valid destination are rejected with an intercept tone rather than being passed to the network.

## Caller ID validation

Each trunk has a set of numbers it is authorized to present as outbound caller ID. On every outbound call:

- If the presented caller ID **is authorized** on the trunk, it passes through unchanged.
- If it **is not authorized** (or no caller ID is sent), Cloud Voice **overrides** it to one of the trunk's authorized numbers, the call still completes, but never with a number the trunk doesn't own.
- If the trunk has **no authorized numbers**, the caller ID is set to anonymous.

Every override is logged, so repeated misconfigurations (or spoofing attempts) are visible. If your outbound calls show an unexpected caller ID, the number your PBX is sending is most likely not authorized on that trunk.

## Caller ID override

Separately from validation, you can configure a trunk-level **caller ID override**: a single number, in E.164 format (`+1XXXXXXXXXX`), that outbound calls on the trunk present regardless of what your equipment sends. The number must be one you own on your account. This is useful when you want every call from a site to show the main line.

## International calling controls

Each trunk carries its own international dialing policy, built from country codes:

- **Allow list**: country codes the trunk may call. Use `*` to allow all countries.
- **Block list**: country codes that are always refused, even if the allow list is `*`.

For example, an allow list of `44, 49` permits calls to the UK and Germany only, while `*` with a block list of `961` allows everywhere except Lebanon. Configure this per trunk from its detail panel, see [Create & Manage Trunks](/sip/trunks/create/).

:::caution[Toll-fraud protection]
Keep international dialing as narrow as your business allows. Compromised PBXs are most commonly abused to pump traffic to expensive international destinations, a tight allow list caps the damage.
:::

## STIR/SHAKEN signing

Outbound calls are signed with a STIR/SHAKEN identity token as they leave Cloud Voice, so downstream carriers can verify the caller ID is legitimate. You don't need to configure anything, see [STIR/SHAKEN](/sip/stir-shaken/) for how attestation works and what to expect.