SIP trunk requirements

Everything a PBX needs to register and place calls on a Check Networks SIP trunk. Your trunk’s own registrar, SIP user and settings are on the trunk’s page in the portal (Services → SIP Trunks, then the trunk); this page covers what is the same for every trunk.

Registrar and domain

Setting	Value	Notes
SIP server / registrar / domain / realm	the registrar shown on your trunk	The same value in every field that asks for a server, domain or realm. Use the name, never an address.
Outbound proxy	leave blank	The name resolves to more than one border server; a fixed proxy address defeats failover.
SIP user / auth ID	your 6-digit SIP user	Shown against the trunk on its page in the portal.
Registration expiry	600 s requested, up to 3600 s honoured	Your Expires value is echoed back up to 3600. 3CX re-registers at the returned value minus 10%.
NAT keepalive	every 25 s from the network	Holds the NAT pinhole open; no port forwarding is needed.
Session timer	300 s Session-Expires, Min-SE 90 s	Refreshed by re-INVITE or UPDATE (RFC 4028).

DNS, SRV and NAPTR

The registrar publishes address records and SRV records for each transport (_sip._udp.<registrar>, _sip._tcp.<registrar>, _sips._tcp.<registrar>). A SRV-aware PBX follows the published priority and fails over on its own; enable “use DNS SRV” if your PBX offers it. NAPTR is not required: resolve the SRV names directly.

Addresses to allow-list

Signalling for your calls arrives from, and must be allowed to, every address the registrar and its SRV targets resolve to: an inbound call may be delivered by any of them. Your trunk’s page in the portal lists them as read from DNS. To check them yourself, resolve the registrar and each SRV target, for example dig SRV _sip._udp.<registrar> and then dig each target.

Media (RTP) is anchored on the same platform; allow the return UDP traffic for calls your PBX places, as any stateful firewall does by default.

Ports and transports

Transport	Port	When
UDP	5060	Default. If registrations work but calls fail before ringing, the INVITE is probably too large for UDP: use TCP.
TCP	5060	Robust for large messages; one connection held open through NAT.
TLS	5061	Encrypts signalling. The server name must be the registrar exactly: certificate validation is by name, no wildcards. Required when the trunk mandates SRTP.
WSS	443	Browser (WebRTC) clients only.

Codecs, DTMF and SRTP

• Codecs offered by default: PCMA, PCMU, G722, in that order, in both directions. Your outbound offer is answered with your own first codec from that list and transcoded on our side when the carrier answered another, so a G.722-first offer completes on G.722 with no “codec mismatch”. Offer PCMA first to avoid transcoding altogether: that is what the carrier side answers natively.
• DTMF: RFC 2833 (telephone-event) by default; supported modes are RFC 2833 (telephone-event) and Inband (audio frequencies). SIP INFO is not delivered.
• SRTP: per trunk. A trunk set to require SRTP rejects a plaintext offer with 488 Secure media (SRTP) required rather than downgrading; use TLS for signalling on such a trunk.

Error codes

The response your equipment shows is specific; quote it verbatim when you contact support.

Response	Meaning	What to do
401 Unauthorized	Registration challenge on a handset domain — expected on the first REGISTER; your device answers it with credentials.	Nothing, unless it repeats with correct credentials: then the username or password is wrong.
407 Proxy Authentication Required	The challenge a SIP trunk domain sends on REGISTER and on each INVITE. 3CX, RingQ and Yeastar expect this form.	Nothing — it is the normal first exchange. A loop of 407s means the credentials are wrong.
403 Forbidden	Credentials rejected (wrong username, realm or password), or the request came from an address the service does not permit.	Check the 6-digit SIP user and the password, and that the SIP domain is the realm. For an IP-authenticated trunk, check the source address is on the allow-list.
403 Caller ID not configured	The service has no default caller ID to present.	Ask your provider to set the trunk’s default caller ID.
403 Call type not permitted	The dialled destination class (international, premium, satellite …) is not enabled on the service.	Ask your provider to enable the call class.
403 Destination not permitted	The number is in a class the service is barred from, or is a private/invalid destination.	Check the number; ask your provider about the bar.
403 Destination blocked	The number is on a fraud or scam block list.	Contact your provider if you believe the block is wrong.
403 International calling suspended	International calling on this service has been suspended (usually after a spend-velocity alert).	Contact your provider to lift the hold.
403 Account temporarily suspended	The account is on hold.	Contact your provider.
403 Insufficient Credit	A prepaid balance cannot cover the call.	Top up.
486 Busy Here	The service’s concurrent-call limit is reached, or the called party is busy.	Wait, or ask your provider to raise the channel count.
488 Secure media (SRTP) required	The service requires encrypted audio and the offer was plaintext.	Enable SRTP on your equipment (and use TLS for signalling).
503 Service temporarily unavailable	The platform could not verify credentials because its authentication store is unreachable. Distinct from 403: your credentials were NOT rejected.	Retry after the Retry-After interval; the platform is recovering.
503 Calls-per-second limit exceeded	The service dialled faster than its calls-per-second allowance.	Slow the dialler; ask your provider if the allowance is too low.
503 Server Overloaded	The border server shed load.	Retry; a SRV-aware client fails over to the next server.
503 Node draining	That border server is being taken out of service for maintenance.	A SRV-aware client re-registers elsewhere; nothing to do.

3CX

• Registration: the trunk domain challenges with 407 (Proxy-Authenticate), which 3CX expects. Register with the 6-digit SIP user as both “Authentication ID” and “SIP user”.
• Inbound call matching: the rinstance parameter 3CX puts in its Contact is echoed and preserved in the Request-Line of inbound INVITEs, so “match by rinstance” works.
• Called number: take “CalledNum” from the To: User Part. The Request-URI user is your authentication ID; the To header carries the dialled DID in +E.164.
• DID list format: +E.164, e.g. +61….
• 3-way authentication: not supported. The digest username is pinned to the From user; leave 3CX’s “3-way authentication” off.
• SRTP: set “Enforced” on a trunk that requires SRTP, otherwise “Disabled”. “Enabled” (opportunistic) is untested against this network.
• TLS: upload ISRG Root X1 to 3CX’s trusted roots; the registrar you enter must match the certificate name exactly, with no wildcards.