You are deploying Direct Routing by using a certified Session Border Controller (SBC). The FQDN of the SBC is sbc1.contoso.com. You use signaling port 5067. You cannot place calls and receive an error

Disabled SIP options would affect the health monitoring of the SBC but would not fully block call signaling in a way consistent with a firewall-blocked port error.

A failover timer of 0 seconds would cause immediate route failover to a backup trunk, not a complete inability to place calls.

Licenses in Microsoft 365 are assigned to user accounts, not to domains; the contoso.com domain itself does not require a license assignment for Direct Routing to function.

Direct Routing SIP signaling between the SBC and Microsoft 365 must traverse the firewall on the configured port, in this case 5067. If the firewall blocks this port, the SBC cannot establish a SIP trunk with Microsoft's infrastructure, resulting in an error state shown in the Teams admin center. All inbound and outbound SIP traffic on the designated signaling port must be explicitly permitted.