> ## Documentation Index > Fetch the complete documentation index at: https://docs.orbit.devotel.io/llms.txt > Use this file to discover all available pages before exploring further. # Do-Not-Originate (DNO) Caller-ID Blocking > Configure the origination-time Do-Not-Originate gate: block invalid, unallocated, or inbound-only numbers from being used as your outbound caller ID, with per-organization extend/replace/subject override modes. # Do-Not-Originate (DNO) Caller-ID Blocking A Do-Not-Originate (DNO) list holds the numbers that must never appear as a **calling-party number** (the caller ID you present on an outbound call). Numbers on such a list are invalid, unallocated, or inbound-only — spoofed government, bank, or IRS lines; inbound-only toll-free; unassigned ranges. Originating a call with one of these as the `from` number is the spoofing pattern that regulators (CTIA, FCC robocall mitigation, ITG traceback) and carrier KYC audits ask about first. Orbit runs a DNO check at **origination time, before dispatch**: after the caller ID is resolved and validated as an active tenant-owned number, it hard-rejects any `from` matching a DNO entry with `422 VOICE_DNO_BLOCKED`. The list is **yours to curate** — the platform ships it empty by default, because there is no universally-safe DNO set, and a bad default would block legitimate caller IDs. DNO is a **tenant-owned protective control**. Orbit does not mandate a DNO posture and does not populate your list. An empty list (the default) makes the check a cheap no-op, so existing tenants are unaffected until you opt in. This page is not legal advice. *** ## 1. The three-layer model The effective DNO set for your organization reconciles a platform baseline with a per-organization override: | Layer | Where it lives | What it holds | Default | | ----------------------------- | ------------------------------------------------- | ------------------------------------------- | ------------------------------------- | | **Platform env baseline** | `DEVOTEL_VOICE_DNO_NUMBERS` (CSV) | A globally curated set, operator-maintained | **Empty** — no universal safe default | | **Per-organization override** | `organizations.settings.voice.dno_override` JSONB | Your own entries, in one of three modes | **Off** | | **Resolved effective set** | Computed at origination time | The merged list of prefixes | — | The override `enabled` flag must be the literal boolean `true`; missing, malformed, or `false` entries are ignored and the env baseline alone applies. *** ## 2. Choose a mode: extend, replace, or subtract The override harmonizes with your baseline in one of three modes: | Mode | Effect | When to use it | | ---------------------- | -------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------ | | **`extend`** (default) | Your entries are **added** to the env baseline | Most tenants — add spoof-bait numbers of your own: inbound-only toll-free DIDs, unassigned allocations, honeypot numbers | | **`replace`** | Your entries **replace** the env baseline entirely | You run your own full DNO list and want the platform baseline excluded | | **`subtract`** | Your entries are **removed** from the env baseline | Waive one baseline entry that wrongly matches a number you legitimately own | Prefer **`extend`** unless you have a specific reason to cut the platform baseline out of the set or need to carve back one entry. *** ## 3. Configure the override Only workspace **owners and admins** can write this. Over the API, send a `PUT /api/v1/settings/general` payload carrying the `voice.dno_override` object: ```json theme={null} { "voice": { "dno_override": { "enabled": true, "mode": "extend", "numbers": ["+1800555"] } } } ``` * `enabled` — must be `true` for the override to take effect. * `mode` — `extend` (default), `replace`, or `subtract`. * `numbers` — DNO entries. Entries are normalized: only `+` and digits are retained, so `800555` and `+1 800 555` both canonicalize. Unusable entries are discarded rather than polluting the set. The same shape is writable in the dashboard under the organization's voice settings section. *** ## 4. How matching and failure behave * **Prefix matching**: matching is a prefix comparison, not exact-match. A full E.164 entry (`+18005551212`) blocks only that number; a shorter entry (`+1800555`) blocks an entire unallocated or inbound-only range. One semantic covers both the specific-spoofed-line and whole-range cases. * **Fail-open on lookup error**: if the organization-settings lookup fails (a transient blip), the gate falls back to the env baseline rather than blocking every outbound call. An empty resolved list makes the check a no-op. * **Reject**: a match throws `422 VOICE_DNO_BLOCKED`: ```json theme={null} { "error": { "code": "VOICE_DNO_BLOCKED", "message": "The selected caller ID is on the Do-Not-Originate (DNO) list — it is invalid, unallocated, or inbound-only and cannot be used to originate calls. Pick a verified number you own as the caller ID.", "details": { "matched_prefix": "+1800555" } } } ``` For triage of this and sibling codes, see [Troubleshooting: voice destination and emergency blocks](/troubleshooting/voice-destination-blocks). *** ## 5. Worked example — inbound-only toll-free spoofed An org keeps an 800-series of inbound-only toll-free numbers. Spoofers are using them as caller ID, damaging the org's reputation. 1. The owner/admin adds those toll-free prefixes to the DNO list: ```json theme={null} PUT /api/v1/settings/general { "voice": { "dno_override": { "enabled": true, "mode": "extend", "numbers": ["+1800555"] } } } ``` 2. A robocaller presenting `+18005550199` as the caller ID is rejected with `422 VOICE_DNO_BLOCKED` before any SIP dispatch. The `matched_prefix` in the response identifies the entry that fired. 3. The next step is the caller-ID allowlist on the trunk or dialer: only verified numbers the org owns should be presented. *** ## 6. Where it sits in the pre-dispatch chain DNO is one of the voice pre-flight gates. Ordering: 1. **Caller-ID resolution and ownership validation** — the `from` number is resolved and validated as active. 2. **DNO check** — rejects a forbidden calling-party before any billing hold or dispatch. 3. **Billing hold / dispatch** — only reached after DNO passes. On the customer-trunk path, the trunk caller-ID allowlist (`VOICE_CALLER_ID_REJECTED`) runs in parallel — both gates protect the caller-ID identity independently. DNO rejects pre-dispatch like the emergency short-code block, not post-dispatch like the [per-destination auto-blocks](/compliance/voice-destination-auto-blocks). *** ## 7. Tenant-ownership framing Compliance is the tenant's responsibility; Orbit is the conduit. DNO is a **tenant-owned protective control**: the platform ships it empty deliberately so no default blocks a legitimate caller ID. You opt in, you curate, you own what gets listed. The resolved set exists at origination time only for the check — it is not a persistent posture register. STIR/SHAKEN [attestation](/compliance/attestation) is weakened when the caller ID is unprovable, so DNO pairs with attestation: block spoofable numbers at origination, present numbers you own so the carrier can attest A. ## See also * [Troubleshooting: voice destination and emergency blocks](/troubleshooting/voice-destination-blocks) — the `422 VOICE_DNO_BLOCKED` code and triage. * [Voice destination auto-blocks](/compliance/voice-destination-auto-blocks) — the per-destination post-dispatch voice gate. * [STIR/SHAKEN attestation posture](/compliance/attestation) — ownership attestation for your caller IDs. * [Send gates](/compliance/send-gates) — the full pre-dispatch chain. * [SIP trunk setup](/guides/sip-trunk-setup) — trunk-side caller-ID allowlist. * [Error codes reference](/reference/error-codes) — the error catalog.