Blog

In 2017, the IAB Tech Lab introduced ads.txt to stop domain spoofing in programmatic advertising. Today, if your site serves programmatic ads, that tiny plain-text file in your server root is your first line of defense. A missing or incorrect ads.txt can cost you revenue and leave your domain vulnerable to fraud. For developers and security-minded site owners, understanding how it works is a basic hygiene measure — not just a publishing concern.

The Problem Ads.txt Solves

Before 2017, ad exchanges had no reliable way to verify that the seller offering an impression actually owned the domain they claimed. A bad actor could fraudulently list a premium site like example-news.com and sell its inventory on an exchange, while the real site never saw a cent. This practice, domain spoofing, cost the industry billions annually. The IAB Tech Lab created the Ads.txt standard (Authorized Digital Sellers) to give publishers a simple, machine-readable way to declare which ad sellers are authorized to sell their inventory.

How Ads.txt Works

The file lives at and contains one line per authorized seller. Each line follows a strict format:

<SellerDomain>, <PublisherID>, <RelationshipType> [, <CertificationAuthorityID>]

Breaking down the fields:

• SellerDomain — The domain of the ad exchange, SSP, or network that you authorize to sell your inventory (e.g., google.com, appnexus.com).
• PublisherID — Your unique identifier on that seller’s platform (e.g., your AdSense publisher ID or your AppNexus member ID).
• RelationshipType — Either DIRECT (you have a direct contractual relationship with the seller) or RESELLER (the seller is authorized by another party, such as a partner network).
• CertificationAuthorityID (optional) — An identifier from an accredited certification authority, used for the Ads.cert extension (rarely required today).

For example, a simple ads.txt for a site using Google AdSense might look like:

google.com, pub-1234567890123456, DIRECT, f08c47fec0942fa0

The last hex string is Google’s certification authority ID — you can obtain it from your ad platform’s documentation.

Why Developers Need to Care

You might think ads.txt is only for ad ops teams. But as a developer you’re often the one deploying it, integrating it into CI/CD pipelines, or troubleshooting why ad revenue dropped after a site migration. Here are the key reasons to pay attention:

• Revenue protection — Without a valid ads.txt, ad exchanges may reduce bids or exclude your inventory entirely, because they cannot trust its authenticity.
• Brand safety — A missing or incorrect file leaves your domain vulnerable to spoofing, which can damage your reputation if fraudulent ads appear under your name.
• Security hygiene — ads.txt is a lightweight, server-side control that requires no user interaction. It’s a perfect example of a defense-in-depth measure that costs almost nothing to implement.
• Automation — If you manage multiple sites or use a static site generator, you can programmatically generate and validate ads.txt files.

Implementing Ads.txt on Your Server

Placement is straightforward. Create a file named ads.txt (exactly that, no extension other than .txt) and upload it to the document root of your web server. Ensure the file is accessible via . The file must be served with Content-Type: text/plain and should not be blocked by robots.txt. Most CDNs and hosting platforms allow this without special configuration.

For developers who want to automate the process, here is a minimal Python script that fetches and validates the structure of an ads.txt file:

import requests
import re

def check_ads_txt(domain):
    url = f"https://{domain}/ads.txt"
    try:
        response = requests.get(url, timeout=10)
        if response.status_code != 200:
            return False, f"HTTP {response.status_code}"
        lines = response.text.strip().split('n')
        for line in lines:
            line = line.strip()
            if line.startswith('#') or line == '':
                continue
            parts = [p.strip() for p in line.split(',')]
            if len(parts) < 3:
                return False, f"Invalid line: {line}"
            if parts[2] not in ('DIRECT', 'RESELLER'):
                return False, f"Invalid relationship: {parts[2]}"
        return True, "Valid"
    except Exception as e:
        return False, str(e)

print(check_ads_txt("example.com"))

This script is a starting point — in production you would want to verify the seller domain against a known list and check the certification authority ID format.

Common Mistakes and How to Avoid Them

Even experienced developers sometimes trip over these details:

• Missing the file entirely — After a server migration or domain change, the old ads.txt may be lost. Always include it in your deployment checklist.
• Wrong relationship type — Using DIRECT when you actually have a reseller agreement can cause discrepancies in reporting and may even lead to your inventory being rejected by premium buyers.
• Duplicate entries — Listing the same seller domain multiple times with different publisher IDs can confuse buyers. Keep one line per authorized seller.
• Incorrect publisher ID — A typo in the ID means the exchange cannot match the line to your account. Double-check the ID in your ad platform’s dashboard.
• Blocking the file in robots.txt — While ads.txt is meant for machines, some crawlers may still try to access it. Do not disallow it unless you have a specific reason.

To verify your file, use the free validator provided by Google in the Ad Manager interface, or third-party tools like the IAB’s Ads.txt Validator. You can also manually check by opening in a browser and reviewing the lines.

Ads.txt and Cybersecurity: A Natural Fit

For readers focused on defensive security, ads.txt is a textbook example of an authorization control applied to a digital supply chain. It does not prevent all forms of ad fraud — sophisticated actors can still exploit other vectors — but it raises the bar significantly. By implementing it, you reduce the attack surface for domain spoofing and signal to exchanges that you take inventory integrity seriously.

ads.txt also ties into broader concepts like digital hygiene and secure configuration management. Just as you would harden your SSH configuration or set proper file permissions, maintaining an accurate ads.txt is a low-effort, high-impact security practice that belongs in every developer’s toolkit.

What About Ads.cert and the Future?

The IAB Tech Lab has also introduced Ads.cert, a cryptographic extension that uses signed tokens to verify each impression in real time. While Ads.cert is not yet widely adopted, it builds on the foundation of ads.txt by adding a trust chain. For now, ads.txt remains the baseline requirement for most premium ad exchanges. If your site participates in programmatic advertising, start with ads.txt and monitor the industry for when Ads.cert becomes mandatory.

Check your domain’s ads.txt right now. Open a browser and go to . If you see a 404 or a list that hasn’t been updated in months, you’ve found a security and revenue gap. Fix it today — your site’s reputation and your ad revenue depend on it.