diff --git a/specs.json b/specs.json
index 2807bf3..ef7363f 100644
--- a/specs.json
+++ b/specs.json
@@ -317,7 +317,11 @@
       "amd": "#amd",
       "dub": ["#dub"],
       "tag": "object",
-      "forwardPAI": "boolean"
+      "forwardPAI": "boolean",
+      "srtpEncryption": {
+        "type": "string",
+        "enum": ["sdes", "dtls"]
+      }
     },
     "required": [
       "target"
diff --git a/test/jambonz-verb-test.js b/test/jambonz-verb-test.js
index 49f049a..032dd81 100644
--- a/test/jambonz-verb-test.js
+++ b/test/jambonz-verb-test.js
@@ -867,4 +867,31 @@ test('non-synonym verbs are unchanged', async (t) => {
   ]);
   t.equal(Object.keys(result2[0])[0], 'llm', 'llm verb is not transformed');
   t.end();
+});
+
+test('dial: srtpEncryption sdes/dtls validate; invalid value rejected', async (t) => {
+  for (const mode of ['sdes', 'dtls']) {
+    try {
+      validate(logger, [{
+        "verb": "dial",
+        "target": [{"type": "sip", "sipUri": "sips:alice@example.com;transport=tls"}],
+        "srtpEncryption": mode
+      }]);
+      t.pass(`dial with srtpEncryption=${mode} validates`);
+    } catch (err) {
+      t.fail(`dial srtpEncryption=${mode} should validate: ${err}`);
+    }
+  }
+
+  try {
+    validate(logger, [{
+      "verb": "dial",
+      "target": [{"type": "sip", "sipUri": "sips:alice@example.com"}],
+      "srtpEncryption": "aes"
+    }]);
+    t.fail('dial with invalid srtpEncryption should not validate');
+  } catch (err) {
+    t.ok(/must be one of/.test(err.message), 'invalid srtpEncryption value rejected');
+  }
+  t.end();
 });
\ No newline at end of file