OECD Anti-Spam Toolkit (2006)

The Anti-Spam Toolkit of Recommended Policies and Measures was produced by the OECD Task Force on Spam (created by OECD Council approval in 2004; mandate ended June 2006). The Toolkit was declassified on 29 March 2006 by the ICCP and CCP committees; the accompanying Council Recommendation on Cross-Border Co-operation in the Enforcement of Laws Against Spam was adopted by the OECD Council on 13 April 2006. At the time the OECD had 30 member countries; the Recommendation also invites non-member economies to take account of it.

The Toolkit is the closest thing to an internationally agreed reference architecture for national anti-spam policy. It is a policy/enforcement framework — it does not itself impose obligations on senders — and it explicitly folds in two industry best-practice documents (BIAC/MAAWG for ISPs; BIAC for email marketers) as Annexes.

Age caveat — what still holds, what is dated

The Toolkit predates SPF/DKIM/DMARC maturity, the 2024 Gmail/Yahoo bulk-sender mandates, mobile-first messaging, and modern reputation systems. Its technical sections (Element IV) reference SPF, "DKIM/META", Sender-ID, greylisting, BATV/SES, PTR checks — historically interesting but superseded by the dedicated articles in this KB. What remains directly useful today is the policy and cross-border enforcement scaffolding: the legislative-design checklist, the consent taxonomy, the "who is liable" reasoning, the enforcement-co-operation model, and the ISP/sender best-practice lists (which the M3AAWG documents later elaborated). Read this article for the framework; read the linked deep articles for current technical practice.

The eight elements

The Toolkit is organised around eight inter-related elements of a comprehensive public-policy framework:

#	Element	Core proposition
I	Regulatory approaches	Clear, simple anti-spam legislation setting what is/isn't allowed
II	Enforcement	Empowered authorities, fast sanctions, cross-border co-operation
III	Industry-driven initiatives	Self-regulation, codes of conduct, AUPs coupling with the law
IV	Technical measures	Layered anti-spam tools; no single method suffices in isolation
V	Education & awareness	Educate recipients and senders; target users, groups, SMEs
VI	Co-operative partnerships	Public-private collaboration in design and enforcement
VII	Spam metrics	Measure to evaluate policy/technical effectiveness (MAAWG Email Metrics Program noted)
VIII	Global co-operation (Outreach)	Extend the framework to non-OECD economies; bilateral/multilateral aid

Element I — Regulatory design

Legislation should aim to preserve the benefits of electronic communication, prohibit and sanction spamming as defined by national law (the value of legislation depends on the certainty of sanctions being applied), and reduce the amount of spam by targeting different stages of the send.

Four general legislative principles:

• Policy direction — outline the main objectives early; they should underlie the whole strategy.
• Regulatory simplicity — the legislation should be short and simple.
• Enforcement effectiveness — pair with an effective sanction regime, appropriate standards of proof, and resourced authorities. Bad enforcement makes good legislation useless.
• International linkages — because spam is cross-border, foresee co-operation and information exchange with foreign authorities.

Legislative best-practice checklist

The Toolkit's regulatory-element table — a useful design checklist for any jurisdiction drafting or comparing anti-spam law:

Issue	Recommended approach
Services concerned (scope)	Choose technology-specific (target current problem media) or technology-neutral (flexible, future-proof). Real-time voice could be regulated separately.
Commercial purpose	Decide whether the law covers only commercial/transactional messages or also non-commercial (political, religious). Specific categories may be expressly excluded (e.g. academic institutions to their alumni).
Consent	Three approaches, often blended: expressed (active permission = opt-in); inferred/implicit (from conduct or existing business relationship); assumed (presumed until removed = opt-out).
Unsubscribe address	Messages should carry a functional opt-out; implies a valid return address, and a postal address may also be required. Absence of these, or failure to stop within the legal period, should be sanctionable.
Information about message origins	Prohibit falsified/concealed headers and sender ID; require the marketer supporting the sender to be clearly identified.
Not bulk	E-mail may be classified as spam only above a volume threshold — typically 50–100 messages over 24 hours — to avoid catching legitimate bulk mail (newsletters).
Labelling	Law may require a specific label for advertising or pornographic content.
Person authorising/benefiting	Sanction not only the physical sender but whoever commissioned, authorised, or profited financially — easier to identify and aids enforcement.
Harvesting & dictionary attacks	Additional sanctions where address-harvesting software, harvested lists, or automatic address generation are used.
Illegal access	Forbid unauthorised use of protected computer resources (compromised machines used to send).
Misleading/fraudulent content	Scams/phishing may be ordinary computer-related crimes; anti-spam law may add deceptive-subject-heading prohibitions and interlock with anti-fraud/consumer law.
Security threats (malware)	Often criminalised via statute or the Council of Europe Convention on Cybercrime.
Cross-border jurisdiction	Cover messages sent to or from the jurisdiction and those commissioned/benefiting from within it; empower authorities for cross-border co-operation.

This checklist maps onto the concrete national regimes covered elsewhere in this KB — CAN-SPAM (US) (opt-out/assumed-consent model), CASL (Canada) and UK PECR (expressed/opt-in), EU ePrivacy & GDPR, and Australia's Spam Act.

Element II — Enforcement & the Council Recommendation

The Recommendation on Cross-Border Co-operation in the Enforcement of Laws Against Spam (Annex I) is the Toolkit's binding-in-spirit core. It covers serious violations only — conduct that (a) causes or may cause injury (financial or otherwise) to a significant number of recipients, (b) affects particularly large numbers of recipients, or (c) causes substantial harm. The decision to assist always rests with the Spam Enforcement Authority receiving the request.

Governments should improve their legislation to:

1. Establish a domestic framework of laws, enforcement authorities, and practices.
2. Improve authorities' ability to co-operate with foreign counterparts (share information, provide investigative assistance).
3. Improve procedures for co-operation — prioritising requests, using common resources and networks.
4. Develop co-operative models between enforcement authorities and private-sector entities.

The Recommendation's four operative parts:

Part	Obligation on member countries
(a) Domestic framework	Maintain effective laws + Spam Enforcement Authorities; give them authority to obtain evidence, investigate and act in a timely manner against violations committed from or affecting their territory; enable action against both senders and those who profit from the sending; review frameworks periodically; consider redress for financial injury.
(b) Ability to co-operate	Provide mechanisms to share information with foreign authorities on request (subject to safeguards); enable investigative assistance (obtaining information/documents/records, locating persons/things); designate a contact point and register it with the OECD Secretariat, which keeps and publishes the list.
(c) Procedures	Before requesting assistance, do preliminary investigative work to confirm a request is warranted; prioritise requests; use common resources (the OECD spam website, informal channels, existing enforcement networks).
(d) Private-sector co-operation	Authorities, businesses, industry groups, and consumer groups should co-operate — on user education, referral of complaint data, and sharing of investigation tools, analysis, and trend information; encourage co-operation to locate and identify spammers, reduce inaccurate domain-registration data, and make the Internet more secure.

The OECD instructed its ICCP and CCP committees to monitor progress within three years. This model — designated contact points, prioritised mutual assistance, private-sector data sharing — is the ancestor of the practical escalation and referral channels described in Cross-Provider Escalation & Mitigation Channels and the abuse-report intake in Abuse Desk.

Element III — Industry-driven initiatives

Anti-spam law should be coupled with private-sector self-regulation. The Task Force welcomed BIAC and MAAWG's best-practice work and noted that in some jurisdictions such codes could be formally registered with the national enforcement agency, enabling the authority to compel compliance if the industry association cannot.

Actors and their duties:

• Providers of online services/goods — respect customer privacy; adopt clear company e-mail policies (e.g. never ask for personal information or, ideally, never put a clickable link in an e-mail, applied consistently); authenticate mail or use digital signatures; pre-empt phishing via clear domain names and defensive domain registration, look-alike-site monitoring, and control of "bounced" messages; educate customers on what mail the company will/won't send.
• Direct marketers — adopt and implement a code of conduct for electronic marketing; build stricter relationships with ISPs to reduce false positives; align codes with anti-spam law nationally and internationally.
• ISPs and network operators — implement self-regulation; adopt and enforce Acceptable Use Policies (AUPs) as contractual terms whose breach allows suspension/termination; inform subscribers about anti-spam/anti-virus filtering.

BIAC/MAAWG best practices for ISPs and network operators (Annex II)

"ISPs and network operators" = any entity operating an SMTP server connected to the Internet. Each practice applies only where not contradicted by national law:

#	Practice
1	Address compromised end-user equipment — timely processes to manage/eliminate it as a spam source
2	Use industry-standard authentication for email and/or sources
3	Block potentially infecting attachments; where content-filtering, obtain prior customer agreement as required by law
4	Actively monitor inbound and outbound volume to detect unusual activity and its source, and respond
5	Establish inter-company processes for reacting to other operators' incident reports; accept end-user complaints
6	Communicate security policies and procedures to subscribers
7	Send non-delivery notices (NDNs) only for messages originated by their own account holders (avoids backscatter)
8	Ensure only their account holders use their mail submit servers (submission authentication)
9	Maintain accurate WHOIS / DNS / IP-registration records (WHOIS, SWIP, RWHOIS) with role points of contact (postal, phone, email) for resolving abuse
10	Ensure all public IPs have correct forward and reverse DNS, WHOIS/SWIP entries, and RFC 1918 compliance for private space

These are the direct precursors of the M3AAWG Senders BCP and the operational controls in Sending Infrastructure Practices; role-account/WHOIS hygiene is expanded in Abuse Desk, and PTR expectations in IPv6 Reverse DNS.

BIAC best practices for email marketing (Annex III)

A voluntary code for marketers; where national law is stricter, the law governs. Nine recommendations plus technical tips:

#	Recommendation
1	Respect the consent requirements of the country from which the marketer operates (unless knowingly/intentionally targeting another country's consumers)
2	Keep records of opt-in/opt-out requests so lists can be cleaned before broadcasts — record proof of consent incl. date/time, originating IP, collection URL/medium, provided on request
3	In all marketing mail (excluding transactional), provide an obvious, clear, efficient email- or web-based opt-out; not buried; confirm the opt-out without requiring further consumer action
4	Every message must clearly identify the sender; subject line and body must accurately reflect content, origin, and purpose; sender ID placed above the fold where possible. Avoid "free offers"/"winning prizes" subject lines (spam-filter triggers). Include the sender's main postal address.
5	Provide a link to the sender's privacy policy
6	Marketers/list brokers/owners must ensure list addresses were obtained legally — review broker privacy policy and collection procedures; obtain contractual warranty of legal collection
7	High discretion when marketing to children/young people; adult content (sexually explicit, gaming/gambling, tobacco, alcohol, firearms) needs age-appropriate handling and the prefacing tag "SEXUALLY EXPLICIT" in the subject line where applicable; seek parental permission where required
8	Have a fair, effective, confidential, easy-to-use complaint-handling system
9	May disclose existing-consumer addresses to third-party affiliates or within a family of companies only if used consistently with collection purpose, an easy opt-out exists, or consent was given; be transparent about brand relationships

Technical tips for electronic marketers (Annex III):

• All servers (inbound, outbound, websites) should have reverse-DNS (PTR) entries; forward and reverse lookups should match; sending machines should HELO/EHLO with that name.
• Publish SPF and/or domain-key (DKIM predecessor) records for senders and third-party sites associated with a mailing; keep current.
• Assign IP addresses distinct from other site servers to outbound mail servers.
• Keep WHOIS records accurate and complete.
• Keep role accounts (postmaster@, abuse@) functional and actively monitored for all sender domains, including sites referenced in content.

Bounce handling (Annex III):

Bounce type	Rule
Hard (5xx) — no such user / mailbox unavailable	Promptly suppress the address across all lists once refusals exceed 3 or more in 14 days. If a 5xx indicates spam blocking (not a bad address), the address may be reactivated once the block is removed.
Soft (4xx) — transient failure	Remove when refusals exceed 5 in consecutive campaigns from a single list, or 5 in aggregate across several lists within 10 days.

Compare the modern, provider-specific handling in Enhanced Status Codes, List Hygiene & Sunset Policies, and Suppression-List Architecture.

Elements IV–VIII (brief)

• IV Technical measures — no single tool suffices; layering (origination, backbone, gateway, recipient) drastically reduces spam. Superseded by this KB's authentication, transport-security, and filtering articles.
• V Education & awareness — governments run public campaigns; ISPs use their customer channels (website, portal, SMS, newsletters) to explain how to avoid spam, which filters exist, how to report abuse, and the abuse-desk contact. "The education of recipients is as important as the education of senders."
• VI Co-operative partnerships — anti-spam strategy should be developed in public-private partnership; ISPs and enforcement authorities should be in contact to signal spam cases and share network data.
• VII Spam metrics — measure to evaluate national strategies; the Task Force welcomed and encouraged MAAWG's Email Metrics Program.
• VIII Global co-operation (Outreach) — make the Toolkit and best practices available to non-OECD economies; promote anti-spam activity abroad through bilateral/multilateral arrangements. A companion site (historically www.oecd-antispam.org) hosted updated national spam-law information and the list of national enforcement focal points.

Why this still matters for running an ESP

The Toolkit is the reference an operator reaches for when a question is jurisdictional or cross-border rather than technical: which legislative model a target country follows, how enforcement authorities co-operate across borders, what an ISP's AUP and abuse obligations look like in policy terms, and how sender/marketer best practices were codified before M3AAWG formalised them. For day-to-day deliverability the specific provider requirements and authentication standards elsewhere in this KB govern; the OECD framework governs the legal and inter-agency layer around them.