10DLC and toll-free registration: what carriers check and what to keep

10DLC stands for ten-digit long code: an ordinary-looking US phone number used by software to send text messages to people. The industry calls this application-to-person messaging, or A2P. Before a number can carry that traffic, the business behind it is registered as a brand and each messaging purpose is registered as a campaign. The Campaign Registry holds those registrations and publishes a fee sheet for them, and messaging platforms such as Twilio and Bandwidth submit them on a customer's behalf.

Toll-free numbers used for texting go through a separate process called toll-free verification. Telnyx's support documentation describes that process as now mirroring 10DLC, which is why this guide treats the two together.

The consequence of skipping registration is direct. Twilio's support documentation says unregistered 10DLC messages to US numbers were fully blocked from 1 September 2023, that a blocked message returns error 30034, and that the blocked message is still billed.

The requirement attaches to application-sent traffic. Twilio's notice about blocking draws no line between marketing and other messages: unregistered 10DLC traffic to US numbers is blocked.

In practice the registration is often filed by someone other than the business named in it. Marketing agencies and software resellers register senders for many client businesses through a platform account. Each client is still its own brand with its own campaign, its own website and its own opt-in flow, and a reviewer assesses each one separately.

Registration carries fees. The Campaign Registry's fee sheet lists changes effective 1 August 2025, including an Authentication+ charge of 12.50 US dollars per request that applies to public for-profit brands. Platforms and resellers set their own prices around these fees, so the amount a business pays depends on where it registers.

A reviewer works from what the submission says and what the business's public pages show. The review compares four things: the identity of the business, the description of the campaign, the sample messages, and the place where a person gives their number and agrees to be texted.

Most of the published rejection reasons sit in the last of those. Reviewers open the website, look for the opt-in form or the described opt-in method, and read the privacy policy and terms to see whether they cover text messaging. A site that cannot be reached, a policy that is missing, or a form that does not match the description is enough to stop the review.

Platforms publish the reasons a registration can be rejected, and some attach error codes to them. Bandwidth's support pages list the vetting rejection reasons it returns. Twilio's error catalogue includes 30925 for a pre-checked opt-in box, 30931 for an opt-in that does not let the consumer decline, and 30886 for a vague campaign description.

Read together, the published reasons fall into a short list. The privacy policy is missing, cannot be reached, or conflicts with the submission. The policy says mobile information is shared with third parties. The privacy policy and terms do not mention text messaging. The opt-in flow does not show where the privacy policy is. The person cannot sign up without also agreeing to texts. The registered use case and the actual message content do not match.

None of these are judgments about whether the business is legitimate. They are findings about pages and wording, which is why the same business can be rejected several times and then approved after changing a form and two documents.

For registration, the proof a reviewer wants is the opt-in flow itself: a live page or a clear description of the method, showing the consent wording next to the place where the number is entered. A screenshot of a form helps a reviewer, but it shows only what the form looked like on one day.

For the life of the campaign, proof means a record per subscriber. If a carrier, a platform or a customer later questions a message, the business needs to show what that particular person agreed to. That requires the wording and the event, tied together and dated.

Consentra's Sender Check checks a registration against the published rejection reasons and keeps a consent record per subscriber. The carriers and the registry make the approval decision, and no tool can promise the outcome.

• The exact consent wording shown, including the message frequency and opt-out instructions it stated
• The address of the page or the description of the method (web form, keyword, paper form, verbal script)
• The action the person took, such as ticking an unchecked box or sending a keyword
• The date and time, and the device or network details available
• The phone number, and the business the consent names
• The privacy policy and terms versions linked at that moment
• Any later opt-out, with its date

The first change concerns toll-free numbers. Telnyx and Bandwidth documentation describe a business registration number as mandatory for toll-free verification from 17 February 2026. Bandwidth's notice says submissions without it are rejected immediately, under its denial code 1112. A business that verified a toll-free number before that date under looser rules should expect the stricter standard on any new submission.

The second change concerns how rejections are explained. Twilio's support documentation says that from 15 September 2026 it uses new shared error codes with more specific rejection reasons for both A2P 10DLC and toll-free verification. Sinch reports that toll-free rejection codes grew from 38 to 83 in May 2025 and to 118 from 15 September 2026; the second figure comes from Sinch's community post and has not been confirmed by a carrier source.

More specific codes make a rejection easier to act on. They do not change what is being checked. The underlying requirements about opt-in and policy wording are the same ones described above.

The Campaign Registry does not appear to publish a count of registered brands or campaigns, or a rejection rate. Figures that circulate in vendor guides are estimates without a stated source, and this guide does not repeat them as fact.

What can be said is that a rejection costs time and sometimes money. The Campaign Registry's fee sheet lists charges that recur when a brand is vetted again, so a submission that fails for a fixable reason is worth catching before it is filed.

Approval also does not settle delivery. Subtext, a messaging vendor, notes that registration does not ensure messages are delivered, and that consent, content, sending behaviour and list quality still matter afterwards.

Approval is granted on the basis of a specific description, specific sample messages and specific pages. If any of those change, the registration and the reality drift apart, and a mismatch between the registered use case and actual content is one of the published rejection reasons.

An agency that registers senders for many clients has the same duty many times over. Keeping each client's material separate, with dates, makes it possible to answer a platform's question about one sender without searching through the rest.

Whether any particular retention period applies to your business under law or a platform contract is a question for your counsel. The list below is a practical minimum drawn from what the published rejection reasons ask a business to show.

• The brand and campaign submissions exactly as filed, with identifiers and approval dates
• Every rejection notice and the change made in response
• Dated captures of the opt-in page each time its wording or layout changes
• Dated versions of the privacy policy and terms
• The message templates in use, and when each was introduced
• One consent record per subscriber, and one opt-out record per subscriber who leaves