A lot of the allowlists we get asked to look at have a similar history. Somebody exported a top-domains report a few years back, a few sites got added along the way because someone asked for them, and the same file has been copied into every campaign since. When we ask why a particular domain is on there, usually nobody knows, and often the site looks nothing like it did when it was added.
It’s worth fixing, because an allowlist (or whitelist, depending on what your DSP calls it) gives you far more control over where your ads run than a blocklist does. Blocklists are always a step behind, since new AI slop sites and made-for-advertising sites appear faster than anyone can add them. With an allowlist, your ads only run on properties you’ve chosen.
That only helps if the properties were chosen well, and that’s true whether you’re a brand buying in-house, an agency, or anyone else responsible for where a media budget ends up. In this post we’ll go through how we’d build an allowlist from scratch: getting inventory reports from your SSPs, filtering them by category, brand safety and quality signals, and using your previous campaigns’ delivery data to decide what stays. We use DeepSee for the filtering steps, as you’d expect, but the overall process applies, whatever tools you have.
Start with supply you can actually buy
It’s common to start an allowlist by writing down well-known sites. The trouble is that the result tends to be short, and some of those sites won’t be available through the SSPs and deals you actually buy from. We’d start with inventory reports instead, so the list is based on what’s really on offer to you.
Ask your SSPs for an inventory report
Most SSPs will send an inventory or avails report to a buyer on request. If you don’t deal with SSPs directly, your agency, DSP or curation partner can usually get one for you. Ask for the last 30 days, limited to the countries and formats you plan to run. The fields we’d ask for are:
- Domain, or app bundle ID and store URL for mobile and CTV
- Seller or publisher ID, and whether the relationship is direct or resold
- Format and placement type (display, video, native, CTV)
- Country
- Available volume, as bid requests or impressions
- Floor price or average clearing price
- Deal ID, if the inventory is part of a PMP or curated deal
You won’t always get every field. Domain or bundle, seller ID and volume are the ones we’d push for.
Pull the same data from your DSP
Your DSP’s site and app reports show what you’ve bought before and what you paid for it. If your DSP has an inventory discovery or forecasting tool, export from that as well, since it will include inventory you could win but haven’t yet. Having both is useful because the SSP report covers everything the exchange has, while the DSP data reflects what you can reach with your own seat and bids.
Keep the extra columns
At this point people often paste everything into one column of domains and delete the rest. Try to keep seller, volume and price alongside each domain, because you’ll need them later on to pick supply paths and to check that the finished list is big enough to spend your budget.
Clean up the list
Raw exports need some tidying before they’re usable. This part is tedious, but it saves a lot of confusion later.
- Split web domains, mobile apps and CTV apps into separate lists. They’re verified in different ways, and you’ll probably upload them to your DSP separately anyway.
- Lowercase the domains, strip any protocols and paths, and decide whether you’re working with root domains or subdomains.
- Don’t change app bundle IDs. They’re case sensitive, and lowercasing them will stop them resolving (there’s more on this in our app inventory playbook).
- Delete rows you can’t identify: blanks, IP addresses, “unknown”, masked domains, and any ad tech domains that have ended up in the site field.
- Remove duplicates. The same domain will show up from several SSPs, so merge those into one row and note which sellers offer it.
- Set a minimum volume. Most exports have a very long tail of properties with almost no impressions, and it usually isn’t worth reviewing them.
You should end up with a list of everything you could buy, with volume and price next to each entry.
Filter by category and topic
There will still be far too many sites to check by hand, and the categories that come through in bid requests are declared by the seller, so they aren’t always accurate. This is the point where we’d upload the domain list to DeepSee, which classifies each property based on the content we’ve crawled from it.
Agree on the context first
Before filtering anything, it helps to write down which topics you want your ads to appear alongside, which you don’t mind, and which you want to avoid completely. Teams often skip this and reuse whatever the last campaign had, which is how a list built for one product launch ends up on a campaign aimed at a completely different audience.
Apply the category filters
DeepSee classifies each property using the IAB v3 content taxonomy, with a few custom labels of our own for site types like news and social media. Filter the list to the categories you want or don’t mind, and take out the ones you want to avoid.
Some things we’d check as you go:
- Whether the declared category matches what we found. If a site is sold as personal finance and the pages are mostly celebrity slideshows, we’d treat that as a warning sign about the site generally.
- Large general-interest sites. A national news or lifestyle site might only have a small section on your topic and still be a good place to run. We’d keep those and use contextual targeting in the DSP to reach the relevant pages.
- Language and country. A site can be on topic and still be in the wrong language for the market, so check the top language we detected across its articles.
Try not to make it too narrow
It’s easy to end up with a list that is very relevant and far too small. Someone shopping for running shoes also reads the news and looks up recipes, so there’s a good case for including quality sites outside the core topic. If you need more scale, we’d add more categories before relaxing any of the quality checks. We wrote more about this in From Safety to Affinity.
Check brand safety
Categories describe what a site is about. The Brand Safety Scan checks a site’s content against four categories:
- Arms & Ammunition
- Adult Content
- Gambling
- Drug Content
A flag means we detected content in that category on the site. It doesn’t necessarily mean the content appears in a risky or unsafe context, so a news site covering a change in gambling law could be flagged in the same way as a casino affiliate. For that reason we’d look at flagged sites before removing them. On a strict allowlist most advertisers will still take out anything that’s flagged, unless they work in that area themselves (a licensed sportsbook will obviously want gambling content).
The adult flag covers more than a site’s own content. It’s also raised when a site links to or advertises adult sites, and when we find code from known adult ad networks on its pages, which catches sites that look harmless at first glance.
Content specific to the advertiser
Past those four, what to exclude depends on the advertiser, which is usually called brand suitability. An alcohol brand and a children’s entertainment company will have very different lists, so go back to the topics you wrote down earlier and remove whatever is on the avoid list.
DeepSee also reports the average sentiment, polarity and subjectivity of a site’s articles. That can help if the advertiser is sensitive to very negative or highly opinionated content.
What an allowlist won’t cover
An allowlist controls which sites and apps you buy, but it has no say over which page the ad appears on. News is the usual example. A well-run news site is a perfectly good property, and on any given day it will still publish stories that some brands would rather not sit next to.
Our view is that you should handle this with page-level contextual settings in your DSP and leave the news sites on the list. Taking news off altogether loses a lot of reach, and that spend has to go somewhere, often to lower quality sites.
Check risk and quality signals
Some sites are on topic and brand safe and still aren’t worth buying, because of how they’re built, where their traffic comes from, or how their inventory is sold. That’s what this step looks at.
Remove the high risk sites first
The quickest filter is the high risk flag, a single yes or no that’s true if a site has any of our high risk signals. For an allowlist we’d remove almost everything it catches. These are the signals behind it:
| Signal | What it means |
| MFA | The site is on our made-for-advertising list. A separate flag covers sites with a subdomain flagged as MFA, since that inventory can end up in the same line of your reports. |
| Template site | Non-unique content and generic design. These have a lot in common with MFA sites but don’t depend on paid traffic. |
| Piracy | The site makes rights-protected material available without permission, or is a laundering site linked to a piracy operation. |
| Pop-sourced traffic | The site gets traffic from popunder or redirect networks, so it tends to open in a new tab or window out of the user’s view. |
| Embedded | The site is loaded underneath the content of other sites, generally where the user can’t see it. |
| Pop creator | Visitors are at risk of having their browser hijacked by unwanted pop-ups and redirects. |
| Spoofer | We’ve seen ad tags on this site load with a different page URL from the one we visited. |
| Spoofed | We’ve seen ad tags declare this domain as the page URL when we weren’t visiting it. |
| Malware | We’ve observed malware when visiting the site. |
| Ad clutter | An excessive ad experience that we’ve categorised manually, because the site evaded our crawlers’ density measurements. |
| High ad density | Ads take up 40% or more of the viewport on average. |
| High risk UX | At least half of the site’s Chrome User Experience metrics come back with poor scores. |
Piracy sites generally can’t monetise openly, so they tend to come with the other problems in this table, such as laundering domains and ad-funded pages loaded out of view. We’ve written up examples in A Case Study in Monetizing Piracy and DeepStreamer.
MFA sites are worth a note as well, because they often look fine in campaign reports. They tend to have high viewability and low CPMs, since that’s what they’re designed for, which is why our definition of MFA relies on what we observe on the site itself.
The spoofed flag is the exception to “remove everything”. The site may be perfectly good, and the flag means other sites have been passing themselves off as it. If you keep a spoofed domain, be strict about which sellers you buy it from, which we come to below.
Then look at the supporting signals
The remaining signals aren’t high risk on their own. They’re useful for deciding borderline cases and for ranking what’s left.
| Signal | What it shows |
| Newly registered | The domain was registered in the last 90 days. New sites deserve extra scrutiny and shouldn’t be getting the share of spend that established sites do. |
| Big mover | The site’s ranking has large spikes and troughs, which is a sign of sourced traffic. See our article on sourced traffic. |
| Possible misinformation | The site appears on the Iffy index of untrustworthy news sources. |
| Ad density | The average and peak share of the viewport taken up by ads, with and without native units, plus percentiles against all other sites. |
| Ad refresh | The average, 75th and 90th percentile time between ads loading in a slot. |
| Pop-ups and redirects | The average number of each during our visits. |
| Low quality text | The share of articles flagged for low quality text, at low, medium and high confidence. |
| Template, theme and plugin uniqueness | How common the site’s combination of templates, themes and plugins is across all the domains we track. |
| Author signals | The number of authors we detected, and how often the author is “admin” or just the domain name. |
| Page weight and requests | How heavy and busy the site is, as percentiles against all other sites. |
| Traffic rank | The site’s Tranco global rank. |
A note on the low quality text signal. It uses detectors trained to tell human and machine-written text apart, but we treat the output as a measure of language quality and wouldn’t describe it as AI detection. The low confidence version can be thrown off by tables and listicles, so for established publishers we’d filter on the medium or high confidence columns. There’s more background in our post on AI slop sites.
We wouldn’t set hard cut-offs on most of these, because they’re more useful in combination. A newly registered domain with a very common template, “admin” as the author and a short refresh time is a much bigger concern than an established site that happens to refresh its ads too quickly. We covered the general point in The Myth of the Perfect Signal.
Well-known publishers need the same checks. We found a few years ago that some large publishers buy incentivised traffic, so we wouldn’t wave a site through because of its name.
These are all web signals. Apps have their own set, including app-ads.txt status, developer URL trust and privacy policy checks.
Check the supply path
For the properties that are left, go back to the seller column in your inventory report. DeepSee shows whether each site has an ads.txt file, how many entries are in it, and what share of those entries can be matched to a sellers.json file. It also shows the owner and manager domains declared in ads.txt, and where those are missing we infer the likely owner or manager from the seller domains that appear most often.
Use these to check that the sellers in your report are listed in the site’s ads.txt, and to see who actually runs its monetisation. We’d choose direct sellers where there’s a choice and remove any seller the publisher hasn’t listed, particularly for domains with the spoofed flag. Buying a good site through an unlisted reseller means extra fees at the very least, and there’s a chance the impression isn’t from that site at all.
Audit your previous campaigns
The steps so far are about inventory you could buy. You also have data on inventory you’ve already bought, and most teams don’t look at it much once the campaign report has gone out.
Auditing it is useful for two reasons. It shows which sites have worked for you, and it shows how much budget went to sites that wouldn’t pass the checks above. That second number tends to be what persuades whoever signs off the budget that the allowlist is worth the effort.
Export a site-level delivery report
From your DSP, or from your agency or buying partner if they run the campaigns, export the last two to four quarters at domain and app level. Include as many of these as you can:
- Domain or app bundle
- Exchange and seller ID
- Impressions, spend and CPM
- Viewability, and completion rate for video
- Clicks and CTR
- Conversions and CPA, or whichever outcome the campaign was measured on
- Invalid traffic rates from your verification vendor
Log-level data is better if you have access to it, because the standard reports often group a lot of small sites under “other”.
Add the quality data
Upload the domains and apps from that report to DeepSee as a separate list, export the signals, and match them back to the delivery report in a spreadsheet. You’ll then have performance and quality data in the same row for each property.
We’d look at both together. Performance numbers on their own can favour sites that are good at inflating metrics, and quality signals on their own won’t tell you what your audience responded to.
Group the results
We find it easiest to split the properties into four groups:
The group that causes the most debate is the sites that fail the quality checks and performed well. Someone will usually point out that one of them had the best CTR on the plan. We’d still remove them from your allowlist, because arbitrage sites are designed to produce good-looking metrics. A very high click rate with no conversions behind it, or 100% viewability on a page with a dozen ad slots, probably says more about the page layout than about how interested people were.
Other things to check
- How concentrated the spend was. If a few hundred domains took nearly all the budget, the remaining thousands weren’t adding much.
- How much was spent on flagged sites. Add up the spend on anything with a high risk or brand safety flag. An earlier post of ours put MFA at around 15% of ad budgets, so it’s worth knowing your own figure.
- Sites near the top by spend that you don’t recognise. Look up their compliance reports.
- Seller IDs that don’t appear in the domain’s ads.txt. If there are mismatches, you may not have been buying the inventory you thought you were.
- Delivery outside the old allowlist, if there was one. This tends to be app inventory or impressions where no domain was passed.
- Sites on the old list that got no impressions. They may no longer be available to you, or the floor may be too high, and they make the list look bigger than it really is.
Use the best outcome metric you have
The audit is more useful if the performance column is conversions or sales, since viewability and CTR are fairly easy for a site to inflate. In our own case studies, higher quality inventory did better on completion rate and viewability, though it’s worth checking whether that holds in your data.
Put the list together
You’ll now have two lists that have been through the same checks: available inventory from the SSP reports, and sites from your previous campaigns. Combine them. Sites that appear on both are the ones we’d be most confident about.
Split it into tiers
With one flat list you have to either hold every site to the strictest standard or lower the standard for all of them. We prefer three tiers:
- A core tier of sites that are on topic, pass every check, are available from a direct seller, and ideally have performed for you before.
- A scale tier of sites that pass the brand safety and quality checks but are broader in topic. Most of your reach will come from here.
- A test tier for sites that look good and that you haven’t bought before. Give these a small budget and review them after a few weeks.
Review it manually
The filters should have brought the list down to somewhere between a few hundred and a few thousand properties, and it’s worth having a person look through them before launch. We built List Review in DeepSee for this. It shows each property with its data, lets you mark it to keep or remove using keyboard shortcuts, and removes everything you’ve marked in one go at the end. More than one person can work on the same list, and there’s an automatically generated summary if you want an overview first.
Check it’s big enough
Using the volume column, add up the available impressions across the list for your countries and formats, and compare the total with what the campaign needs.
If the list is too small, CPMs go up, frequency gets too high and the campaign under-delivers. What tends to happen next is that someone turns the allowlist off to hit the delivery target, and it doesn’t get turned back on. If you’re short, we’d add sites to the scale tier by widening the categories and leave the quality checks as they are.
Export it and keep notes
Export the allowlist as a CSV and upload it to your DSP, or send it to your SSP or curation partner to set up as a deal. If an agency or another partner does the buying for you, give them the list and ask them to confirm it has been applied. Save the rules you used, the date and the source reports alongside it, so that when someone asks why a site is or isn’t included you can find the answer quickly.
We’d also keep your existing blocklists in place, particularly any seller-level and app-level blocks, since a domain allowlist doesn’t cover those.
Keep the allowlist up to date
Sites change. They get sold, add more ad units, start buying traffic, or replace their writers with AI-generated content while keeping the same domain. A list that was accurate at launch will have some bad entries after a few months if nobody checks it.
What we’d suggest:
- Save the allowlist as a list in DeepSee so the signals stay current. The data is also available through the API and webhooks if you’d like to utilise it in your own tools.
- Once a month, look at what’s changed, remove anything that no longer passes, and move test-tier sites up if they’ve done well.
- Once a quarter, get new inventory and delivery reports and go through the process again. This matters for adding sites as well as removing them, because a list that only gets shorter will eventually struggle to deliver.
- Note the reason and date whenever a site is added or removed. It makes the next review much quicker.
Where to start
If that sounds like a lot, the campaign audit is the easiest place to begin. You already have the delivery report, and running it against quality data will usually show quickly whether your current allowlist needs work.
If you’d like help with that, or want to see how your existing allowlist scores in DeepSee, get in touch.
