PBXfactory

Yeastar P-Series 84.21: STIR/SHAKEN and SSO

Published November 10, 20254 min readby The PBXfactory team

Yeastar P-Series Cloud 84.21.0.16 adds STIR/SHAKEN, which signs outbound calls and checks inbound caller IDs on shared trunks, Red Hat SSO sign-in for Linkus Desktop and Web, and feature codes that let users pick their outbound caller ID from a phone.

Yeastar released firmware 84.21.0.16 for P-Series Cloud Edition on 10 November 2025. It is a release about trust in who is calling and who is signing in: caller ID authentication with STIR/SHAKEN, single sign-on with Red Hat for the Linkus apps, and a cleaner way for users to choose which number their outbound calls show. Below is what each change does, based on Yeastar's release notes.

What is STIR/SHAKEN in Yeastar 84.21?

STIR/SHAKEN is a set of standards that lets phone networks check that a caller really owns the number they show. The calling side signs the call; the receiving side verifies the signature. It exists to fight spoofed caller IDs and robocalls, and the US regulator, the FCC, requires voice providers there to use it.

In 84.21, Yeastar's notes describe it like this:

  • Outbound calls are signed on shared trunks with attestation level A — the highest level, meaning the provider vouches for the caller and the number. Emergency and anonymous calls are left out.
  • Inbound calls are verified, either by the carrier or by the PBX, depending on the settings. Calls that fail can be rejected automatically.
  • Results are logged per call in the call detail records (CDR), and a notification can tell chosen contacts when a call is rejected for failing verification.
  • It is configured centrally in Yeastar Central Management (YCM) and applied through shared trunks — the trunks a service provider manages for many PBXs at once.

Who it is for

If your calls run over North American networks, this matters. In most of Europe, caller ID protection works differently and is handled by your carrier. And because the PBX feature works on shared trunks set up in YCM, a PBX that uses its own SIP trunk relies on that carrier for caller ID signing.

Red Hat SSO for Linkus Desktop and Web

Companies that manage identities in Red Hat SSO can now let their people sign in to Linkus Desktop and Linkus Web with those same credentials. One login less to remember, and when someone leaves, switching off their company account also closes this door. It needs the Red Hat SSO integration set up on the PBX, and the single sign-on option switched on for the web client.

It joins the Google sign-in that came with the Google Workspace integration in 84.19.

Choosing your outbound caller ID with feature codes

Many businesses have more than one number: a main line, a support line, a regional number. The outbound caller ID — Yeastar calls it DOD — decides which one the person you call sees. 84.21 makes switching easier:

  • DOD short codes: each outbound caller ID in the list can get its own short code (for the shared outbound caller ID mode).
  • A new feature code, *085 by default: dial it with a DOD number or short code to set your default caller ID, or to place a call with that number.
  • BLF status: put the feature code on a phone's BLF key and the light shows whether that number is currently your default.

For a small team that answers several brands or regions, that turns a settings change into one key press.

Smaller changes worth knowing

The release also tidies a number of everyday details:

  • Paging and intercom recording: a new option records all paging and intercom calls. No notice is played, and participants can't pause or stop it.
  • Emergency number "Strip": removes leading digits from a dialled emergency number, so a user who habitually dials an outside-line prefix still reaches the emergency service.
  • Return 302 on external forward: when an inbound call is forwarded to an outside number, the PBX can tell the carrier to redirect it instead of carrying both legs.
  • Ring group as a Diversion destination, so forwarded calls carry the right Diversion header.
  • Auto provisioning: up to 5 phone firmware files, each up to 800 MB.
  • Upgrade reminder: manual firmware upgrades now remind you to back up first.
  • API: new recording endpoints, and CDR results now include the STIR/SHAKEN attestation.

If you record calls, check the rules in your country before switching on any automatic recording.

What this means for you

On a Yeastar P-Series Cloud PBX from PBXfactory, Yeastar's updates are applied for you in announced maintenance windows — urgent security fixes sooner. Your extensions, trunks and call flows stay as they are.

The new options are switched off until you set them up in the PBX admin panel. Feature codes, DOD short codes and the Red Hat SSO integration are PBX configuration, so Yeastar's documentation is the best guide. If you'd rather have someone do it with you, our support packages cover setup help.

Questions and answers

Does STIR/SHAKEN matter for a business in Europe?
Mostly not. STIR/SHAKEN is the caller ID authentication framework the US regulator, the FCC, requires of voice providers. It matters when you call or receive calls over North American networks. Ask your SIP trunk provider what they do for caller ID checks in your country.
Does STIR/SHAKEN work with my own SIP trunk?
According to Yeastar's notes, the PBX feature is set up centrally in Yeastar Central Management and applies through shared trunks. If you connect your own SIP trunk, caller ID signing is handled by that carrier.
Do I need to install 84.21 myself?
Not on a Yeastar P-Series Cloud PBX from PBXfactory. We apply Yeastar's updates for you in announced maintenance windows, and urgent security fixes sooner.
Where are Yeastar's full release notes for 84.21.0.16?
In Yeastar's release notes for 84.21.0.16 on the Yeastar help center.