ads.txt is a plain text file sitting at yourdomain.com/ads.txt, listing which companies are authorized to sell your ad inventory. That's the whole technology — and it closes a fraud worth hundreds of millions annually: domain spoofing, where scammers sell your traffic to advertisers while you see nothing.
How the fraud works without it
An impostor claims to sell ad space on your domain. Advertisers buy, ads show somewhere else (or nowhere), and the buyer believes they reached your audience. Without ads.txt, buyers have no programmatic way to verify the seller's claim. With it, authorized sellers are listed in your own handwriting, and everything else is identifiable as counterfeit.
The AdSense version, concretely
AdSense tells you its exact line: google.com, pub-XXXXXXXXXXXXXXXX, DIRECT, f08c47fec0942fa0 — your publisher ID slotted in. The file goes in the domain root, served as text. That's it. Sites monetized only through AdSense need this one line; sites using additional networks (Ad Manager, mediation partners) list each authorized account on its own line, using whatever each partner specifies.
The failure modes
Missing file: some demand-side platforms discount or skip your inventory entirely — meaning ads.txt absence is not neutral, it's a revenue haircut. Wrong publisher ID: the file exists and vouches for nobody. Stale file after switching networks: old entries are harmless, missing new ones strangle the new partner's bids. And unreachable file — a server rule or security plugin blocking it — is worse than absent, because it looks deliberate.
Verification, five minutes
Open your domain's ads.txt in a browser. Confirm it's readable text, the IDs match your accounts, and there's no HTML error page pretending to be a text file. Check the AdSense console's ads.txt status flag. Quarterly, re-verify after any network change. It's the highest-value five minutes in ad ops — a fraud shield that costs one file upload.
