OECD Anti-Spam Toolkit (2006)

If you need to compare national anti-spam laws, or to understand how enforcement authorities in different countries work together, the Organisation for Economic Co-operation and Development (OECD) Anti-Spam Toolkit is the closest thing to an internationally agreed reference design for national anti-spam policy.

The Anti-Spam Toolkit of Recommended Policies and Measures was produced by the OECD Task Force on Spam, which the OECD Council approved in 2004 and whose mandate ended in June 2006. The ICCP and CCP committees declassified the Toolkit on 29 March 2006. The OECD Council adopted the accompanying Council Recommendation on Cross-Border Co-operation in the Enforcement of Laws Against Spam on 13 April 2006. The OECD then had 30 member countries, and the Recommendation also invites non-member economies to take account of it.

The Toolkit is a policy and enforcement framework. It does not itself impose obligations on senders. It includes two industry best-practice documents as Annexes: one from BIAC and MAAWG for ISPs, and one from BIAC for email marketers.

What still holds and what is dated

The Toolkit predates mature SPF, DKIM and DMARC, the 2024 bulk-sender requirements from Gmail and Yahoo, mobile-first messaging, and modern reputation systems. Its technical sections (Element IV) refer to SPF, "DKIM/META", Sender-ID, greylisting, BATV and SES, and PTR checks. These are of historical interest, and current practice is covered in dedicated articles on each topic.

What remains directly useful today is the framework for policy and cross-border enforcement: the checklist for designing legislation, the types of consent, the reasoning about who is liable, the model for enforcement co-operation, and the best-practice lists for ISPs and senders, which the M3AAWG documents later expanded. Use the Toolkit for the framework, and the linked references for current technical practice.

The eight elements

The Toolkit is organised around eight related elements of a comprehensive public-policy framework:

Element I: Regulatory design

Legislation should aim to preserve the benefits of electronic communication, to prohibit and sanction spamming as defined by national law, and to reduce the amount of spam by targeting different stages of sending. The value of legislation depends on the certainty that sanctions will be applied.

Four general legislative principles:

• Policy direction: set out the main objectives early. They should underlie the whole strategy.
• Regulatory simplicity: the legislation should be short and simple.
• Enforcement effectiveness: pair the law with an effective system of sanctions, appropriate standards of proof, and authorities with resources. Poor enforcement makes good legislation useless.
• International linkages: spam crosses borders, so plan for co-operation and information exchange with foreign authorities.

Legislative best-practice checklist

The Toolkit's table for the regulatory element is a useful design checklist for any jurisdiction that is drafting or comparing anti-spam law:

The checklist maps onto the national regimes: CAN-SPAM (US) follows the opt-out, assumed-consent model; CASL (Canada) and UK PECR follow the expressed, opt-in model. See also EU ePrivacy & GDPR and Australia's Spam Act.

Element II: Enforcement and the Council Recommendation

The Recommendation on Cross-Border Co-operation in the Enforcement of Laws Against Spam (Annex I) is the core of the Toolkit, binding in spirit. It covers serious violations only: conduct that (a) causes or may cause injury, financial or otherwise, to a significant number of recipients, (b) affects particularly large numbers of recipients, or (c) causes substantial harm. The decision to assist always rests with the Spam Enforcement Authority that receives the request.

Governments should improve their legislation to:

1. Establish a domestic framework of laws, enforcement authorities and practices.
2. Improve the authorities' ability to co-operate with foreign counterparts (share information, provide investigative assistance).
3. Improve procedures for co-operation, by prioritising requests and using common resources and networks.
4. Develop co-operative models between enforcement authorities and private-sector entities.

The Recommendation has four operative parts:

The OECD instructed its ICCP and CCP committees to monitor progress within three years. This model of designated contact points, prioritised mutual assistance and private-sector data sharing is the ancestor of today's practical escalation and referral channels, described in Cross-Provider Escalation & Mitigation Channels, and of abuse-report intake, described in Abuse Desk.

Element III: Industry-driven initiatives

Anti-spam law should work together with private-sector self-regulation. The Task Force welcomed the best-practice work of BIAC and MAAWG. It noted that in some jurisdictions such codes could be formally registered with the national enforcement agency, so that the authority can compel compliance where the industry association cannot.

The actors and their duties:

• Providers of online services or goods: respect customer privacy. Adopt clear company email policies and apply them consistently (for example, never ask for personal information, or ideally never put a clickable link in an email). Authenticate mail or use digital signatures. Prevent phishing with clear domain names and defensive domain registration, monitoring of look-alike sites, and control of "bounced" messages. Tell customers what mail the company will and will not send.
• Direct marketers: adopt and implement a code of conduct for electronic marketing. Build closer relationships with ISPs to reduce false positives. Align codes with anti-spam law nationally and internationally.
• ISPs and network operators: implement self-regulation. Adopt and enforce Acceptable Use Policies (AUPs) as contract terms whose breach allows suspension or termination. Inform subscribers about anti-spam and anti-virus filtering.

BIAC and MAAWG best practices for ISPs and network operators (Annex II)

Here "ISPs and network operators" means any entity operating an SMTP server connected to the Internet. Each practice applies only where national law does not contradict it:

These practices are the direct precursors of the M3AAWG Senders BCP and of the operational controls in Sending Infrastructure Practices. Abuse Desk expands on role accounts and WHOIS hygiene, and IPv6 Reverse DNS on PTR expectations.

BIAC best practices for email marketing (Annex III)

This is a voluntary code for marketers. Where national law is stricter, the law governs. It contains nine recommendations and a set of technical tips:

Technical tips for electronic marketers (Annex III):

• All servers (inbound, outbound, websites) should have reverse DNS (PTR) entries. Forward and reverse lookups should match, and sending machines should identify themselves with that name in HELO or EHLO.
• Publish SPF records, domain-key records (the predecessor of DKIM), or both for senders and for third-party sites associated with a mailing, and keep them current.
• Give outbound mail servers IP addresses distinct from the site's other servers.
• Keep WHOIS records accurate and complete.
• Keep role accounts (postmaster@, abuse@) working and actively monitored for all sender domains, including sites referenced in the content.

Bounce handling (Annex III):

For modern, provider-specific handling, compare Enhanced Status Codes, List Hygiene & Sunset Policies and Suppression-List Architecture.

Elements IV–VIII (brief)

• IV Technical measures: no single tool is enough. Layering at origination, on the backbone, at the gateway and at the recipient greatly reduces spam. Current practice is covered under authentication, transport security and filtering.
• V Education and awareness: governments run public campaigns. ISPs use their customer channels (website, portal, SMS, newsletters) to explain how to avoid spam, which filters exist, how to report abuse, and the abuse-desk contact. "The education of recipients is as important as the education of senders."
• VI Co-operative partnerships: anti-spam strategy should be developed in partnership between the public and private sectors. ISPs and enforcement authorities should stay in contact to report spam cases and share network data.
• VII Spam metrics: measure in order to evaluate national strategies. The Task Force welcomed and encouraged MAAWG's Email Metrics Program.
• VIII Global co-operation (Outreach): make the Toolkit and best practices available to non-OECD economies, and promote anti-spam activity abroad through bilateral and multilateral arrangements. A companion site (historically www.oecd-antispam.org) hosted updated information on national spam laws and the list of national enforcement contact points.

Why this still matters for running an ESP

Turn to the Toolkit when a question is about jurisdiction or crosses borders rather than being technical: which legislative model a target country follows, how enforcement authorities co-operate across borders, what an ISP's acceptable use policy and abuse obligations look like in policy terms, and how best practices for senders and marketers were written down before M3AAWG formalised them. For day-to-day deliverability, the specific provider requirements and authentication standards govern. The OECD framework governs the legal and inter-agency layer around them.