That's fucking insane that it's allowed. But if the ability to override the domain is truly that important, then there needs to be manual vetting of the ad buy

That's fucking insane that it's allowed. But if the ability to override the domain is truly that important, then there needs to be manual vetting of the ad buyer and the target domain. I'm sure you could automate it with signed TXT records, but I think there should still be a human in the chain to at least double-check everything.