All content must be served from the ad server’s domain and may not call from other domains.

The correct answer is true because all content served through an ad server must originate from the ad server's domain and cannot call content from other domains. This policy is in place to ensure security, privacy, and reliability in the ad serving process. By restricting content to be served only from the ad server's domain, it helps prevent issues such as cross-site scripting, ad fraud, and data leakage, which could occur if ads were allowed to call external domains. This also ensures compliance with privacy regulations and protects user data by maintaining control over where content and tracking pixels are hosted.