SIP Registration on Signal — Technical Reference

Signal endpoints register over TLS (TCP 5061) by default, authenticate with per-extension credentials, and refresh registration on a ~300-second cycle. Media is SRTP when the endpoint supports it. This page documents the behaviors IT teams ask about when integrating firewalls, SBCs, and third-party endpoints.

Registration flow

1. Endpoint resolves the account registrar domain (SRV records select the serving cluster; A-record fallback applies).
2. TLS session establishes; the endpoint REGISTERs with the extension's SIP username and password (digest authentication).
3. Registration expiry defaults to 300 s; endpoints re-register at roughly half-life. NAT bindings are kept alive by the refresh cycle and transport keep-alives.
4. The platform can verify endpoint liveness (SIP OPTIONS "qualify") — reachability feeds the portal's Last Seen/online status.

Transport and encryption

Transport is set per device; TLS is the default for provisioned phones. Downgrade only for equipment that cannot do TLS, and isolate such devices.

Failover and overrides

• SRV-based failover: endpoints re-resolve and re-register against the next server on connection failure — no configuration required.
• Per-device overrides: primary/secondary proxy address and port can be pinned per device for SBC or split-horizon deployments; an SRV-disable flag forces the pinned path only.

Multiple registrations

An extension accepts up to 10 concurrent registrations; inbound calls fork to all. Registration from a new device does not evict others until the concurrency limit is reached.

Related articles

• Network requirements
• SIP credentials