A2P 10DLC registration: what actually gets you approved

Most 10DLC rejections have nothing to do with your technology. They come from a comma in a legal name, a missing sentence in a privacy policy, or a consent checkbox that was pre-checked. Reviewers are human, they work through a queue, and they stop at the first problem they find.

That last part is what makes rejections expensive. If your submission has three problems, you find out about them one at a time, and each cycle costs days.

The chain

Registration goes brand, then campaign, then number, then message. Each step gates the next.

The brand is the legal entity responsible for the content. The campaign is one specific messaging use case belonging to that brand. Numbers are attached to a campaign. A message references the campaign it belongs to. Traffic that skips any link in this chain is blocked at the carrier, not at your provider.

Brand registration

Brand verification is automated. Your submitted details are cross-referenced against IRS records, Secretary of State filings, and commercial business databases. Any inconsistency fails the check.

The legal name has to match your IRS CP 575 character for character. This is the single most common brand failure. Not the name on your bank account, not the name on your W-9, not the trading name on your storefront. If the CP 575 says Northgate Dental Group LLC, then Northgate Dental Group, LLC fails on the comma. If you have lost the CP 575, the IRS will not reissue it, but they will send a 147C letter that serves the same purpose.

Using a DBA is fine. You declare the relationship in the campaign description with a plain sentence — “We are doing business as Northgate Dental” — and then the DBA can appear in your samples, your consent language, and your consumer-facing copy. Only the brand registration field itself is locked to the verified legal entity.

The address must be a physical location. PO boxes fail. Mailbox services fail. The address should be findable in public records tied to the entity.

An EIN issued in the last 15 days is not yet verifiable. The databases have not caught up. Wait it out rather than burning a registration fee.

The contact email should be on the brand’s own domain. Free email domains weaken verification and are refused outright for publicly traded entities.

The website check

Reviewers open the website you submit. This surprises people.

The site has to be live, served over HTTPS with a valid certificate, and it has to name the registered legal entity somewhere a human can find it. A footer reading © 2026 Northgate Dental Group LLC is enough. A site that shows only the trading name with no legal entity disclosure anywhere fails, because the reviewer cannot connect the public brand to the registered one.

It also needs, clearly linked and reachable without a login:

• A privacy policy on its own URL, on the same domain
• Terms and conditions
• Enough content to establish what the business actually does

Parked domains, template sites with placeholder text, broken links, and “under construction” pages are instant rejections.

Campaign registration

Two fields decide the outcome, and both are free text that people rush.

The description

“Customer care messages” gets rejected. It echoes the dropdown label and names nothing.

“Appointment reminders, confirmations, and post-visit care instructions sent to existing patients of our dental practice” gets approved. It names the message types and identifies the audience.

The message flow

This is where you describe how consent is collected, in enough detail that a reviewer can verify it without contacting you. Name the URL. State that the checkbox is unchecked and that the form submits without it. List every disclosure shown at the point of consent.

If your opt-in sits behind a login, the reviewer cannot see it. Host screenshots of the full flow at a public URL and put that URL in this field. A submission that points at a login page is rejected as unverifiable.

Sample messages

Give at least three: a normal message, the opt-in confirmation, and the HELP reply. Write real examples — an unresolved {{first_name}} merge field reads as an untested integration. Include your brand name and, on recurring programs, the STOP language.

The privacy policy clause

Your privacy policy has to state that mobile information is not shared with third parties for marketing purposes. Its absence is one of the most common campaign rejections in the whole ecosystem, and it is a two-minute fix.

The wording that satisfies reviewers is close to this:

No mobile information will be shared with third parties or affiliates for marketing or promotional purposes at any time. All of the above categories exclude text messaging originator opt-in data and consent; this information will not be shared with any third parties.

Just as important: nothing else in the policy may contradict it. A generic template that says you share personal information with “marketing partners” will fail even if the clause above is present further down the page.

The opt-in form

If you collect consent on a website, the form must satisfy all of these:

• The consent checkbox is unchecked by default
• The form submits without it — a required SMS checkbox is a forced opt-in and is rejected
• SMS consent is separate from email or general terms consent
• Links to your terms and privacy policy sit next to the checkbox, not only in the page footer
• The page is public, HTTPS, and not behind authentication

The consent language itself needs six things: your brand name, the message type, the frequency, the exact phrase “Message and data rates may apply”, how to opt out, and how to get help.

What no rewrite will fix

Some categories are permanently ineligible for 10DLC. Cannabis and CBD, payday and other high-interest lending, third-party debt collection, gambling, and get-rich-quick schemes cannot be made acceptable by changing the copy. If your business is in one of these, the honest options are toll-free messaging, where the rules differ, or a different channel.

Any provider that tells you otherwise is selling you rejection cycles.

When you do get rejected

Get the specific reason code. Then audit the entire submission against every requirement rather than only fixing what was cited, because the review stopped at the first problem and the next one is still waiting.

Resubmitting a rejected campaign is free. Resubmitting a rejected brand costs the registration fee again, which is why the legal name is worth triple-checking before you press submit.