What are the best practices for preventing domain spoofing in RTB auctions?

1 Use ads.txt and app-ads.txt

One of the most effective ways to prevent domain spoofing is to use ads.txt and app-ads.txt files, which are standardized text files that publishers can place on their web servers or app stores to declare the authorized sellers of their inventory. By using these files, publishers can create a transparent and verifiable record of their inventory sources, and advertisers can check if the domains or apps they are bidding on are legitimate and authorized. Ads.txt and app-ads.txt files are supported by most major ad platforms and exchanges, and are widely adopted by the industry.

2 Use sellers.json and SupplyChain object

Another way to prevent domain spoofing is to use sellers.json and SupplyChain object, which are complementary tools that enable buyers to verify the identity and relationship of the intermediaries involved in the RTB auction. Sellers.json is a file that ad exchanges and SSPs can publish to disclose the list of sellers and resellers they work with, along with their seller IDs and transparency status. SupplyChain object is a field that ad exchanges and SSPs can include in their bid requests to provide a complete chain of custody of the impression, from the publisher to the final seller. By using these tools, buyers can trace the origin and path of the inventory they are bidding on, and detect any discrepancies or anomalies.

3 Use pre-bid verification and post-bid measurement

A third way to prevent domain spoofing is to use pre-bid verification and post-bid measurement tools, which are third-party solutions that can help buyers to assess the quality and authenticity of the inventory before and after the auction. Pre-bid verification tools can use various methods, such as domain lists, device IDs, IP addresses, or machine learning algorithms, to filter out fraudulent or suspicious bid requests, and provide buyers with signals or scores to inform their bidding decisions. Post-bid measurement tools can use similar methods, as well as pixel tracking, impression-level data, or blockchain technology, to monitor and validate the delivery and performance of the impressions, and provide buyers with reports or alerts to identify any issues or discrepancies.

4 Use best practices and industry standards

To prevent domain spoofing, buyers and sellers should use best practices and industry standards. HTTPS should be used for all ad requests and responses to ensure the encryption and integrity of the data. OpenRTB 3.0 or higher is recommended, as it supports ads.txt, app-ads.txt, sellers.json, SupplyChain object, and other features that enhance security and transparency. IAB Tech Lab's Content Taxonomy 2.2 or higher should also be used to define content categories and subcategories of the inventory, as well as IAB Tech Lab's Authorized Digital Sellers for Web (ads.txt) Specification 1.0.2 or higher, Authorized Digital Sellers for Apps (app-ads.txt) Specification 1.0.1 or higher, Sellers.json Specification 1.0 or higher, and OpenRTB SupplyChain Object Specification 1.0 or higher which define the format and requirements of the ads.txt, app-ads.txt, sellers.json, and SupplyChain object files respectively. By following these best practices and industry standards, buyers and sellers can reduce the risk of domain spoofing and other types of fraud while increasing trust and efficiency in the RTB ecosystem.