IAB's ads.txt killed domain spoofing with one text file at the web root

Programmatic advertising let anyone list 'publisher X' inventory on an exchange, and buyers had no way to check. In September 2017 the Financial Times found its display ads on 10 exchanges and its video ads on 15 — though the FT sold no programmatic video at all — with 300 accounts peddling fake FT inventory worth an estimated $1.3 million a month.

The IAB Tech Lab's answer, shipped June 2017 as ads.txt, was almost insultingly simple: publishers place a text file at their domain root listing which ad systems may sell their inventory. Only the party that controls the domain can place a file at its root, so the list is self-authenticating. Demand-side platforms crawl the file and refuse bids from unlisted sellers.

Adoption was slow until Google put weight behind it: from November 2017 Google began filtering unauthorized inventory, and in June 2018 its DSP added an ads.txt-only buying option. By July 2018 ads.txt files had passed 600,000 domains (from 164,000 in January), covering roughly 90 percent of Google Ad Manager publisher inventory, and 60 percent of comScore's top 1,000 US publishers had posted the file.

The lever worked because it moved verification cost to zero: a Guardian US test showed that without ads.txt enforcement, over 70 percent of an advertiser's pre-roll video budget could be siphoned by impostor sites. Exchanges like TrustX and MediaMath's curated market then made ads.txt a condition of selling.

A text file only the domain owner can publish becomes a tamper-proof seller list

The domain root is already under the publisher's exclusive control, so no new trusted authority was needed.

A plain text file costs nothing to publish or to crawl, removing every adoption excuse.

Google's demand-side enforcement turned a voluntary convention into a de facto requirement within a year.

The FT's $1.3M/month spoofing estimate gave publishers a concrete revenue reason to post the file.

When a market can't tell real from fake supply, anchor identity in something only the real party controls — a web root, a DNS record — instead of building a central authority.

Ads.txt became table stakes for programmatic selling, was extended to apps and connected TV as app-ads.txt, and gained sellers.json plus OWNERDOMAIN/MANAGERDOMAIN fields to map reseller chains. Domain spoofing did not vanish, but buying 'authorized-only' became a default DSP option.