Server

Number Portability and ENUM

By Prabath Thalangama· October 24, 2026· 4 min read
#telecom#mnp#enum

Introduction

Number portability lets a subscriber keep their number when changing operator. That breaks the old assumption that a number prefix identifies the network, so every call/SMS to a potentially-ported number needs a database lookup to find the real destination network.

Why it's hard

Traditionally, +9477X XXXXXX meant "Operator A's mobile block". With portability, that number might now be on Operator B. If Operator C routes a call by prefix, it sends it to A, who has to bounce it to B (onward routing) — or C must check a database first.

The two routing models

  • All Call Query (ACQ) — the originating (or transit) network dips the portability database for every call to a portable range, gets a routing number (a network-identifying prefix), and routes directly to the current operator. Efficient, no trombone. Used in most modern markets.
  • Onward Routing (OR) — route to the number's original operator, who detects it's ported and forwards to the recipient network. Wastes a transit segment ("tromboning"); legacy.
  • Query on Release (QoR) — route to the original operator, who returns a "ported, go here" release; the originator re-routes. Middle ground.

The database dip

  • SS7 world — a MAP/INAP query (or a national variant) to the NPDB (Number Portability Database) returns the Routing Number (RN) / Location Routing Number (LRN). The switch prepends the RN and routes.
  • In SS7 SMS — sendRoutingInfoForSM toward the number; the portability layer intercepts and answers with the correct network's SMSC/MSC, or the originating SMSC dips the NPDB first.
  • SIP world — a SIP proxy queries the NPDB (often via ENUM or a Diameter/HTTP interface) and rewrites the Request-URI with the routing prefix, or routes to the correct trunk.

Result on the wire is usually a prefix prepended to the dialled number (e.g. RN + MSISDN), which downstream switches use for routing and strip before delivery.

ENUM

ENUM (RFC 6116) maps an E.164 number to URIs (SIP, tel, email, etc.) using DNS. The number is reversed, dotted, and placed under e164.arpa:

+94 77 123 4567  ->  7.6.5.4.3.2.1.7.7.4.9.e164.arpa

A NAPTR query returns rewrite rules:

$ORIGIN 7.6.5.4.3.2.1.7.7.4.9.e164.arpa.
  IN NAPTR 100 10 "u" "E2U+sip"  "!^.*$!sip:[email protected]!" .
  IN NAPTR 102 10 "u" "E2U+pstn" "!^.*$!tel:+94771234567!" .
  • u flag → the result is a URI (terminal).
  • regexp → applied to the original number to produce the URI.
  • Order/preference pick the best match.

Public vs private (carrier) ENUM

  • Public ENUM (e164.arpa) — never took off globally; sparse, trust issues.
  • Carrier ENUM / private ENUM — operators and interconnect providers run their own ENUM tree (e164enum.net, provider-specific zones) as the routing/portability lookup mechanism for IP interconnect (SIP trunking, VoLTE roaming, IMS). This is where ENUM is actually used heavily today — as the number→SIP-route database, including portability data.

Kamailio/OpenSIPS have an enum module: enum_query("e164enum.net") does the NAPTR lookup and rewrites the R-URI.

Verification and troubleshooting

# Manual ENUM lookup
dig NAPTR 7.6.5.4.3.2.1.7.7.4.9.e164.arpa +short
dig NAPTR 7.6.5.4.3.2.1.7.7.4.9.e164enum.net @<carrier-enum-resolver> +short

# SS7 portability dip trace
tshark -i any -O gsm_map,inap,camel -d sctp.port==2905,m3ua
  • Calls to ported numbers fail or loop — no NPDB dip (routing by prefix to the wrong network), OR routing tromboning and the original operator's forward path is broken, or the RN prefix isn't recognised by a transit switch.
  • SMS to ported numbers undelivered — the originating SMSC routes by MSISDN prefix to the old MSC/SMSC; needs an NPDB dip or an SRI-SM that the portability layer answers correctly.
  • ENUM query returns nothing — the number isn't provisioned in that ENUM tree, wrong zone/resolver, or you didn't reverse+dot correctly. Fall back to PSTN/SS7 routing.
  • ENUM NAPTR present but regexp doesn't match — the !pattern!replacement! regex is applied to the full E.164 (+ included or not, per convention); test with the module's debug or dig + manual apply.
  • Wrong route chosen — NAPTR order/preference values; lower order wins, then lower preference. Multiple E2U+sip records with bad ordering.
  • Portability data stale — the NPDB/ENUM zone isn't syncing with the national porting clearinghouse; ports take effect on a schedule (often nightly) — a just-ported number may route to the old network until sync.
PrabathStuck on something this site can't fix?Reach out to Prabath directly on LinkedIn.