A2P SMS deliverability in 2026 - routes, registration and AIT

Deliverability is decided before the message is sent - When an OTP fails to arrive, most teams look at the send. The message was accepted by the API, the delivery receipt said delivered, and yet the customer is on the phone. In practice, the outcome was determined by three decisions taken long before that request: which route the message would travel, whether the sender ID was registered in the destination country, and whether the traffic pattern looked like fraud to somebody's filter. Get those three right and the send itself is the easy part.

Direct routes versus grey routes - An A2P message can reach a handset by a direct connection to the destination operator, by a hub or aggregator with its own operator agreements, or by a grey route that abuses person-to-person interconnects or SIM farms to avoid the operator's A2P termination fee. Grey routes are cheaper, and for a while they work, until the operator's firewall catches the pattern and blocks the source. The message is then silently dropped, or delivered hours later once traffic is rerouted, or delivered with a mangled sender ID. If your traffic is transactional - one-time passwords, alerts, confirmations - the cost saving from grey routing is never worth the failure rate. Ask your provider how many of its operator connections are direct, and specifically which route your traffic to a given country will take. A provider with 800-plus operator connections can be direct on the destinations that matter to you and honest about the ones where it is not.

Sender ID registration is now the norm - Most large markets have moved to a registration model, and unregistered traffic is either blocked or has its sender ID replaced with a generic numeric one. In India, the DLT framework under TRAI requires the enterprise (principal entity), each header (sender ID), each content template and each consent record to be registered on a telecom operator's DLT platform. Messages whose content does not match a registered template are scrubbed. Registration is a genuine project: template approval can take days, variables must be declared correctly, and templates need to be maintained as your product copy changes. In the United States, 10DLC requires brand and campaign registration through The Campaign Registry, with throughput determined by trust score and campaign type; unregistered traffic on long codes is now heavily filtered. In the UAE, sender IDs are registered with the TDRA and each operator, and promotional and transactional traffic are treated differently. Similar schemes exist in Saudi Arabia, Singapore, the Philippines, Indonesia and a growing list of others. Budget the registration lead time into any market launch, and expect to renew or update registrations as rules change.

Artificially inflated traffic - AIT is the most damaging development in A2P messaging in the last few years. A fraudster triggers your OTP flow at scale, often through automated sign-up bots, towards number ranges where they share in the termination revenue. You pay for every message, your conversion metrics collapse, and your provider may throttle you because your traffic now looks like spam. Defences sit at both ends. On your side: rate-limit OTP requests per number, per IP and per device; add friction such as CAPTCHA before the SMS step; block or step up on ranges that show abnormal request-to-verify ratios; and monitor conversion by destination country daily. On the provider side: real-time velocity checks, destination blocking for known AIT ranges, and the willingness to tell you when your traffic pattern changes rather than simply billing it.

What a delivery receipt actually means - A DLR is generated by the terminating operator, or by whoever last handled the message, and it says the message reached the handset, or that it was accepted for delivery, or that it failed. Its usefulness depends on where in the chain it was generated. On a direct route, a DELIVRD status is a handset-level acknowledgement and is reliable. On a routed message through several hops, some intermediaries generate synthetic receipts, and the DLR tells you only that the message left their platform. Ask your provider whether DLRs are operator-originated for the routes you use, and treat DLR rate as a signal about route quality rather than an absolute measure. Latency is worth tracking separately: median and 95th-percentile time from submit to DLR, by country, is one of the most useful dashboards you can build.

Content and formatting still matter - Filters look at content as well as source. URLs, particularly shortened ones, are frequently blocked or trigger review in many markets; use a branded domain and register it where the scheme allows. Avoid mixing promotional and transactional content on the same sender ID where the local rules distinguish them. Respect quiet hours, which are enforced by law in India and by operator policy elsewhere. Concatenated messages are fine but each segment is billed, and Unicode content halves the characters per segment.

Choosing between SMS and its alternatives - For markets where operator fees are high and smartphone penetration is universal, RCS Business Messaging and WhatsApp Business are increasingly viable for transactional flows, with better formatting and read receipts. SMS remains the reachability floor: it works on every handset without a data connection and does not depend on the customer having installed anything. Most robust verification stacks now use SMS as the default and fall back or step up to voice OTP, WhatsApp or silent network authentication depending on the country and the observed failure rate.

A practical checklist - Know the route for each of your top ten countries. Register sender IDs and templates before launch, not after the first block. Rate-limit and monitor OTP requests to stop AIT before it costs money. Track submit-to-DLR latency and conversion by country. Keep content plain and links branded. And ask your provider hard questions; the ones with direct connections will have detailed answers.