Thanks for confirming the diagnosis, Jarrah — that matches exactly what I saw in the trace. I haven't tested it from a separate SIP client yet, but I did find an indirect data point in this same server: another user (Ashik, in an older thread about Asterisk + Elastic SIP Trunking) reported successful call transfers after switching from "Dial to SIP URI" to Elastic SIP Trunking, including transfers to internal extensions on his own PBX. That suggests other SIP stacks (Asterisk in his case) do handle this challenge/auth flow correctly with similar trunk setups, though his telephony provider wasn't Zadarma specifically. I'm happy to test directly against Zadarma with another client to fully isolate this. What would be the simplest way to replicate Retell's exact behavior — an unregistered UAC sending a trunk-style INVITE and expecting to handle the 407 with the trunk credentials (rather than a softphone that REGISTERs first)? Would something like a quick pjsua/sipsak command-line test work, or is there a simpler tool you'd recommend for someone without a dev background?