BroadNet
Fundamentals BroadNet answer

How does HLR lookup and MNP number intelligence work?

Last reviewed 2 min readReviewed by BroadNet engineering
Quick answer

HLR lookup and MNP (mobile number portability) intelligence is real-time number validation that queries the Home Location Register over SS7 to confirm whether a number is active, which operator currently owns it after any porting, and whether it is roaming — all before you send. It removes invalid numbers, corrects routing for ported numbers, and cuts wasted A2P spend and fraud exposure.

Plain-language definitionVendor-neutralReviewed July 22, 2026
The long answer

Everything worth knowing, nothing that isn't.

§01

How an HLR lookup works

The lookup sends an SS7 MAP SendRoutingInfoForSM query to the number's home HLR, exactly as an SMSC would before delivering a message. The HLR responds with the subscriber's status, the current serving network (MCC/MNC), and the IMSI — revealing whether the number is live and reachable without ever sending an SMS. See /answers/what-is-hlr and /answers/ss7-map-explained.

§02

What MNP (number portability) changes

Number portability lets a subscriber keep their MSISDN when they switch operator, so the dial-code prefix no longer reliably identifies the carrier. An HLR/MNP lookup returns the operator that actually owns the number today — essential for routing A2P traffic to the correct interconnect and pricing it correctly. See /answers/what-is-mnp and /answers/what-is-msisdn.

§03

What the response tells you

A typical result flags the number as active, absent, or invalid; returns the current MCC/MNC (network); indicates whether the subscriber is roaming; and shows a ported flag when the number has moved networks. That's the raw material for list hygiene, least-cost routing, and pre-send validation. See /products/hlr-lookup.

§04

Benefits: deliverability, cost, and fraud screening

Scrubbing a list against HLR before a campaign lifts delivery rates by dropping dead numbers, routes ported numbers correctly, and reduces spend on undeliverable sends. It's also a front-line control against artificially inflated traffic (AIT/SMS pumping) — validating numbers before OTP sends stops bots draining your budget. See /answers/what-is-ait and /answers/what-is-sms-pumping.

§05

Limitations to be aware of

Some operators restrict or obscure HLR responses for privacy, so coverage and field completeness vary by country. On 4G/5G cores the HSS (and 5G UDM) replaces the HLR, though the lookup service abstracts that difference. And a lookup is a point-in-time snapshot — status can change between validation and send. See /answers/what-is-hss and /answers/what-is-hlr-lookup.

§06

HLR lookup vs a simple number-format check

A format check (E.164 validation) only confirms a number is well-formed — it can't tell you if the number is real, active, or which network owns it after porting. An HLR lookup queries the live network, so it catches disconnected numbers, corrects ported routing, and screens fraud that format validation misses. Use both: normalise to E.164, then validate against the HLR. See /answers/what-is-e164.

BNWritten by the BroadNet engineering team·Operating carrier-grade messaging since 2003, headquartered in Dubai·Editorial standards
Build with this

Need help wiring this up?

The pages below are the products and integration guides that put this concept on the wire. If you'd rather walk through it live, our engineering team takes calls same-day during MENA working hours.

Talk to our engineering team
References

Source documents we cite.

Standards bodies and regulators referenced in this page. Open in a new tab.

Feedback

Was this answer helpful?

Your vote helps us prioritise which answers to expand with examples, diagrams, and code snippets.

Was this answer helpful?
Thanks — noted. We'll keep this answer maintained.
Got it. Tell us what was missing — send a quick note.

How we write and review content

Still need help?

Talk to a real engineer about your build.

We reply within one business day, and production accounts get 24/7 support. Our solutions engineers ship code, not scripts.

$ curl -X POST https://api.broadnet.me/sms/sendSms
Response SLA
Test-access requestsReply within 1 business day
Production24 / 7 · < 15 min
Operator NOC24 / 7 · pager