A disavow file tells Google to ignore specific links pointing to your site. It's a plain text file with one domain (written as domain:example.com) or one URL per line, uploaded through the disavow links tool in Search Console.
Google says most sites never need one. It already ignores most spammy links on its own. Disavowing is mainly for sites with a manual action for unnatural links, or with a history of paid or manipulative links they can't get removed.
Disavowing good links can hurt you, so only list links you're confident are harmful and that you tried to have removed.
Example
After a previous agency bought links on a network of spam blogs, Margin lists those domains in a disavow file.
Putting it into practice
Where to use it: Disavow file generator.