{"id":139,"date":"2026-10-11T17:01:23","date_gmt":"2026-10-11T14:01:23","guid":{"rendered":"https:\/\/mx1mail.com\/blog\/dmarc-raporlari-rua-ruf-nasil-okunur-aksiyon-plani\/"},"modified":"2026-10-11T17:01:23","modified_gmt":"2026-10-11T14:01:23","slug":"dmarc-raporlari-rua-ruf-nasil-okunur-aksiyon-plani","status":"publish","type":"post","link":"https:\/\/mx1mail.com\/blog\/tr\/dmarc-raporlari-rua-ruf-nasil-okunur-aksiyon-plani\/","title":{"rendered":"DMARC Raporlar\u0131 (rua\/ruf) Nas\u0131l Okunur? Kaynaklar\u0131 Bulma, Yetkilendirme Hatalar\u0131 ve Aksiyon Plan\u0131"},"content":{"rendered":"<h2>DMARC raporlar\u0131 neden \u00f6nemlidir?<\/h2>\n<p>DMARC, alan ad\u0131n\u0131zdan g\u00f6nderiliyormu\u015f gibi yap\u0131lan sahtecili\u011fi (spoofing) azaltmak ve al\u0131c\u0131lar\u0131n SPF\/DKIM do\u011frulama sonu\u00e7lar\u0131na g\u00f6re tutarl\u0131 kararlar almas\u0131n\u0131 sa\u011flamak i\u00e7in kullan\u0131lan bir e-posta do\u011frulama standard\u0131d\u0131r. DMARC\u2019nin en pratik taraf\u0131 ise raporlamad\u0131r: Kimler alan ad\u0131n\u0131z\u0131 kullanarak e-posta g\u00f6ndermeye \u00e7al\u0131\u015f\u0131yor, bu g\u00f6nderimler SPF ve DKIM\u2019den ge\u00e7iyor mu, DMARC uyumu (alignment) sa\u011flan\u0131yor mu gibi sorulara veriye dayal\u0131 yan\u0131t \u00fcretmenizi sa\u011flar.<\/p>\n<p>Bu rehberde DMARC kayd\u0131ndaki rua (aggregate\/toplu rapor) ve ruf (forensic\/adli olay raporu) raporlar\u0131n\u0131n nas\u0131l okunaca\u011f\u0131n\u0131, raporlardan kaynaklar\u0131 nas\u0131l tespit edece\u011finizi ve en s\u0131k g\u00f6r\u00fclen yetkilendirme\/hizalama problemleri i\u00e7in uygulanabilir bir aksiyon plan\u0131n\u0131 ele alaca\u011f\u0131z.<\/p>\n<h2>DMARC raporlama t\u00fcrleri: rua ve ruf<\/h2>\n<h3>rua: Toplu (aggregate) raporlar<\/h3>\n<p>rua ile gelen raporlar genellikle XML format\u0131ndad\u0131r ve belirli bir zaman aral\u0131\u011f\u0131ndaki (\u00e7o\u011funlukla g\u00fcnl\u00fck) \u00f6zet sonu\u00e7lar\u0131 i\u00e7erir. Bir al\u0131c\u0131 kurulu\u015f, sizin DMARC kayd\u0131n\u0131zda belirtti\u011finiz adrese rapor g\u00f6nderir. Bu raporlar tekil e-posta i\u00e7eri\u011fini de\u011fil; kaynak IP\u2019ler, kullan\u0131lan kimlikler ve SPF\/DKIM\/DMARC de\u011ferlendirme sonu\u00e7lar\u0131 gibi istatistikleri g\u00f6sterir.<\/p>\n<h3>ruf: Olay (forensic) raporlar<\/h3>\n<p>ruf raporlar\u0131, DMARC ba\u015far\u0131s\u0131zl\u0131klar\u0131yla ilgili daha ayr\u0131nt\u0131l\u0131 olay verisi \u00fcretmeyi hedefler. Ancak mahremiyet ve veri payla\u015f\u0131m\u0131 k\u0131s\u0131tlar\u0131 nedeniyle bir\u00e7ok al\u0131c\u0131 art\u0131k ruf g\u00f6ndermeyebilir ya da i\u00e7erik k\u0131rp\u0131lm\u0131\u015f olabilir. Ayr\u0131ca ruf, operasyonel olarak daha hassast\u0131r; istemeden ki\u015fisel veri veya mesaj i\u00e7eri\u011fi ta\u015f\u0131nmas\u0131 riskleri do\u011furabilece\u011fi i\u00e7in \u015firket i\u00e7inde politika ve onay s\u00fcreci gerektirebilir.<\/p>\n<h2>Bir DMARC kayd\u0131nda raporlama alanlar\u0131 nas\u0131l \u00e7al\u0131\u015f\u0131r?<\/h2>\n<p>DMARC DNS kayd\u0131nda raporlama i\u00e7in genellikle \u015fu etiketleri g\u00f6r\u00fcrs\u00fcn\u00fcz: rua, ruf, fo, adkim, aspf, pct. Rapor okumay\u0131 anlamak i\u00e7in bu alanlar\u0131n neyi etkiledi\u011fini bilmek gerekir.<\/p>\n<ul>\n<li><strong>rua<\/strong>: Toplu raporlar\u0131n g\u00f6nderilece\u011fi adres(ler). Birden fazla adres eklenebilir.<\/li>\n<li><strong>ruf<\/strong>: Olay raporlar\u0131n\u0131n g\u00f6nderilece\u011fi adres(ler). Her al\u0131c\u0131 desteklemeyebilir.<\/li>\n<li><strong>fo<\/strong>: Hangi ko\u015fulda olay raporu \u00fcretilece\u011fini belirtir (\u00f6r. sadece SPF ve DKIM birlikte fail olursa gibi).<\/li>\n<li><strong>adkim\/aspf<\/strong>: DKIM ve SPF i\u00e7in hizalama modunu (relaxed\/strict) etkiler.<\/li>\n<li><strong>pct<\/strong>: Politikan\u0131n y\u00fczde ka\u00e7 trafik i\u00e7in uygulanaca\u011f\u0131n\u0131 belirler; raporlama a\u015famas\u0131nda kademeli ilerlemede kullan\u0131l\u0131r.<\/li>\n<\/ul>\n<h2>rua raporunu ad\u0131m ad\u0131m okuma: Hangi alanlar ne anlat\u0131r?<\/h2>\n<p>Aggregate raporlar farkl\u0131 ara\u00e7larla g\u00f6rselle\u015ftirilebilir; ancak temel mant\u0131k ayn\u0131 kal\u0131r. A\u015fa\u011f\u0131daki par\u00e7alar, raporun yorumlanmas\u0131nda kritiktir.<\/p>\n<h3>1) Rapor metadatas\u0131: kim raporluyor, hangi d\u00f6nem?<\/h3>\n<p>Raporun ba\u015f\u0131nda raporu \u00fcreten kurulu\u015fun bilgisi ve kapsanan zaman aral\u0131\u011f\u0131 bulunur. Burada as\u0131l hedef, raporlar\u0131n d\u00fczenli gelip gelmedi\u011fini ve hangi al\u0131c\u0131lar\u0131n veri sa\u011flad\u0131\u011f\u0131n\u0131 takip etmektir. Baz\u0131 al\u0131c\u0131lar rapor \u00fcretir, baz\u0131lar\u0131 \u00fcretmez; bu normaldir.<\/p>\n<h3>2) Politika de\u011ferlendirmesi: p\/quarantine\/reject ve disposition<\/h3>\n<p>Rapor, sizin yay\u0131nlad\u0131\u011f\u0131n\u0131z DMARC politikas\u0131n\u0131 (p=none\/quarantine\/reject) ve al\u0131c\u0131n\u0131n uygulad\u0131\u011f\u0131 sonucu (disposition) g\u00f6sterir. \u00d6rne\u011fin p=none iken disposition \u201cnone\u201d olmas\u0131 beklenir; p=quarantine iken \u201cquarantine\u201d veya \u201cnone\u201d gibi varyasyonlar g\u00f6r\u00fclebilir. Bu k\u0131s\u0131m, politikan\u0131n sahada nas\u0131l uyguland\u0131\u011f\u0131n\u0131 anlamak i\u00e7in \u00f6nemlidir.<\/p>\n<h3>3) Kaynak IP ve hacim: en h\u0131zl\u0131 kazan\u0131m alan\u0131<\/h3>\n<p>Raporlarda genellikle <strong>source IP<\/strong> (g\u00f6nderici IP) ve o IP\u2019den gelen <strong>count<\/strong> (adet) yer al\u0131r. \u0130lk yap\u0131lacak i\u015f, y\u00fcksek hacimli IP\u2019leri listeleyip bunlar\u0131n hangi sistemlere ait oldu\u011funu e\u015fle\u015ftirmektir. \u015eirketlerin en s\u0131k unuttu\u011fu kaynaklar; web sitesi formlar\u0131, CRM ara\u00e7lar\u0131, e-ticaret platformu bildirimleri, canl\u0131 destek yaz\u0131l\u0131mlar\u0131, ERP sistemleri ve \u00fc\u00e7\u00fcnc\u00fc taraf SMS\/e-posta otomasyon servisleridir.<\/p>\n<h3>4) Kimlikler: Header From, envelope from ve DKIM d=<\/h3>\n<p>DMARC\u2019nin merkezinde <strong>Header From<\/strong> (kullan\u0131c\u0131n\u0131n g\u00f6rd\u00fc\u011f\u00fc alan ad\u0131) vard\u0131r. Raporlar \u00e7o\u011fu zaman SPF\u2019in hangi domain \u00fczerinden kontrol edildi\u011fini (envelope from\/return-path) ve DKIM\u2019in hangi domain ile imzalad\u0131\u011f\u0131n\u0131 (d=) g\u00f6sterir. Burada hedef, SPF ve\/veya DKIM\u2019in <strong>Header From ile hizal\u0131<\/strong> olup olmad\u0131\u011f\u0131n\u0131 tespit etmektir.<\/p>\n<h3>5) Sonu\u00e7lar: SPF pass\/fail, DKIM pass\/fail ve DMARC pass\/fail<\/h3>\n<p>DMARC \u201cpass\u201d olmas\u0131 i\u00e7in en az birinin (SPF veya DKIM) hem do\u011frulamada ba\u015far\u0131l\u0131 olmas\u0131 hem de Header From ile hizal\u0131 olmas\u0131 gerekir. Bu nedenle raporda SPF pass g\u00f6r\u00fcp DMARC fail g\u00f6rmek m\u00fcmk\u00fcnd\u00fcr (hizalama bozuksa). Ayn\u0131 \u015fekilde DKIM pass olup DMARC fail de g\u00f6r\u00fclebilir (d= farkl\u0131 bir alan ad\u0131na aitse).<\/p>\n<h2>Raporlardan \u201ckim benim ad\u0131ma g\u00f6nderiyor?\u201d sorusuna yan\u0131t \u00fcretme<\/h2>\n<p>Pratikte DMARC raporlar\u0131n\u0131 okuman\u0131n amac\u0131 bir envanter \u00e7\u0131karmakt\u0131r. A\u015fa\u011f\u0131daki y\u00f6ntem, IT ekiplerinin h\u0131zl\u0131 sonu\u00e7 almas\u0131n\u0131 sa\u011flar.<\/p>\n<ol>\n<li><strong>IP bazl\u0131 s\u0131n\u0131fland\u0131rma yap\u0131n<\/strong>: \u015eirketin bilinen mail sunucular\u0131, uygulama sunucular\u0131, ofis IP\u2019leri ve \u00fc\u00e7\u00fcnc\u00fc taraf servis IP\u2019leri olarak grupland\u0131r\u0131n.<\/li>\n<li><strong>Hacmi y\u00fcksek ama tan\u0131ms\u0131z kaynaklara \u00f6ncelik verin<\/strong>: Bu kaynaklar ya kritik bir i\u015f ak\u0131\u015f\u0131d\u0131r ya da k\u00f6t\u00fcye kullan\u0131m belirtisidir.<\/li>\n<li><strong>Kimlik kombinasyonuna bak\u0131n<\/strong>: Header From alan ad\u0131n\u0131z iken return-path veya DKIM d= farkl\u0131ysa, genellikle yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f bir \u00fc\u00e7\u00fcnc\u00fc taraf entegrasyonu vard\u0131r.<\/li>\n<li><strong>Her kaynak i\u00e7in hedef durum tan\u0131mlay\u0131n<\/strong>: \u201cSPF aligned + DKIM aligned\u201d, \u201cen az bir aligned ge\u00e7sin\u201d, \u201casla g\u00f6ndermemeli\u201d gibi.<\/li>\n<\/ol>\n<h2>En yayg\u0131n DMARC rapor bulgular\u0131 ve k\u00f6k nedenler<\/h2>\n<h3>1) SPF fail veya SPF pass ama hizalama fail<\/h3>\n<p>SPF fail genellikle kaynak IP\u2019nin SPF kayd\u0131n\u0131zda yetkili olmamas\u0131 demektir. SPF pass olup hizalama fail olmas\u0131 ise return-path domain\u2019inin Header From ile ayn\u0131 olmamas\u0131 (ve strict alignment kullan\u0131lmas\u0131) nedeniyle g\u00f6r\u00fcl\u00fcr.<\/p>\n<p>\u00c7\u00f6z\u00fcm yakla\u015f\u0131m\u0131: G\u00f6nderimi yapan sistemi belirleyin; ger\u00e7ekten sizin ad\u0131n\u0131za g\u00f6ndermesi gerekiyorsa SPF taraf\u0131nda yetkilendirme veya servis sa\u011flay\u0131c\u0131n\u0131n \u00f6nerdi\u011fi y\u00f6ntemi uygulay\u0131n. E\u011fer \u00fc\u00e7\u00fcnc\u00fc taraf sizin domaininizle hizal\u0131 return-path sa\u011flayam\u0131yorsa, DKIM hizalamas\u0131n\u0131 do\u011fru kurmak daha s\u00fcrd\u00fcr\u00fclebilir olabilir.<\/p>\n<h3>2) DKIM fail veya DKIM pass ama hizalama fail<\/h3>\n<p>DKIM fail; imza eklenmemesi, DNS\u2019te DKIM kayd\u0131n\u0131n bulunmamas\u0131, selector hatas\u0131, anahtar de\u011fi\u015fimi s\u0131ras\u0131nda kopma veya mesaj\u0131n yolda de\u011fi\u015ftirilmesi gibi nedenlerle ortaya \u00e7\u0131kar. DKIM pass olup hizalama fail ise d= alan\u0131n\u0131n Header From ile farkl\u0131 oldu\u011fu anlam\u0131na gelir.<\/p>\n<p>\u00c7\u00f6z\u00fcm yakla\u015f\u0131m\u0131: G\u00f6nderim kayna\u011f\u0131nda DKIM imzas\u0131n\u0131n ger\u00e7ekten aktif oldu\u011fundan emin olun; DNS\u2019te do\u011fru selector kayd\u0131 yay\u0131nlay\u0131n. \u00dc\u00e7\u00fcnc\u00fc taraf servis kullan\u0131l\u0131yorsa \u201ccustom DKIM\u201d veya alan ad\u0131n\u0131za ait DKIM imzalama se\u00e7eneklerini de\u011ferlendirin.<\/p>\n<h3>3) Beklenmeyen IP\u2019lerden gelen denemeler<\/h3>\n<p>Raporlarda \u015firketinizin hi\u00e7 kullanmad\u0131\u011f\u0131 \u00fclkelerden, hostinglerden veya \u015f\u00fcpheli IP bloklar\u0131ndan d\u00fc\u015f\u00fck hacimli ama s\u00fcrekli denemeler g\u00f6rebilirsiniz. Bu \u00e7o\u011fu zaman alan ad\u0131n\u0131z\u0131 taklit etme giri\u015fimidir.<\/p>\n<p>\u00c7\u00f6z\u00fcm yakla\u015f\u0131m\u0131: DMARC politikan\u0131z \u201cnone\u201d ise g\u00f6zlem s\u00fcresi sonras\u0131 quarantine\/reject\u2019e ge\u00e7i\u015f plan\u0131 olu\u015fturun. Ayn\u0131 zamanda SPF\/DKIM\u2019in do\u011fru \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olmadan reject\u2019e ge\u00e7mek me\u015fru postalar\u0131 da etkileyebilir.<\/p>\n<h2>DMARC raporlar\u0131na dayal\u0131 pratik aksiyon plan\u0131<\/h2>\n<h3>1) 1-2 hafta: Envanter ve h\u0131zl\u0131 d\u00fczeltmeler<\/h3>\n<ul>\n<li>Kurumsal g\u00f6nderim yapan t\u00fcm sistemleri listeleyin (CRM, ERP, web formlar\u0131, uygulama bildirimleri).<\/li>\n<li>Her sistem i\u00e7in SPF mi DKIM mi hizalama sa\u011flayacak, karar verin.<\/li>\n<li>Y\u00fcksek hacimli kaynaklarda DKIM ve SPF hatalar\u0131n\u0131 d\u00fczeltin.<\/li>\n<\/ul>\n<h3>2) 2-4 hafta: Politika s\u0131k\u0131la\u015ft\u0131rma provas\u0131<\/h3>\n<ul>\n<li>DMARC p=none a\u015famas\u0131nda raporlar\u0131 stabil hale getirin.<\/li>\n<li>Eksik kaynak kalmad\u0131\u011f\u0131ndan emin olun.<\/li>\n<li>pct kullan\u0131yorsan\u0131z, kademeli art\u0131\u015f plan\u0131 yap\u0131n.<\/li>\n<\/ul>\n<h3>3) 1-3 ay: quarantine ve reject\u2019e kontroll\u00fc ge\u00e7i\u015f<\/h3>\n<ul>\n<li>\u00d6nce p=quarantine ile ba\u015flay\u0131n; raporlar\u0131 g\u00fcnl\u00fck kontrol edin.<\/li>\n<li>Yanl\u0131\u015f pozitif g\u00f6rm\u00fcyorsan\u0131z p=reject\u2019e ge\u00e7in.<\/li>\n<li>Yeni entegrasyonlar devreye al\u0131nd\u0131k\u00e7a DMARC raporlar\u0131n\u0131 tekrar kontrol edin.<\/li>\n<\/ul>\n<h2>Operasyonel ipu\u00e7lar\u0131: raporlar\u0131 s\u00fcrd\u00fcr\u00fclebilir y\u00f6netmek<\/h2>\n<ul>\n<li><strong>Rapor sahipli\u011fi belirleyin<\/strong>: DMARC raporlar\u0131n\u0131 kimin izleyece\u011fi ve aksiyon alaca\u011f\u0131 net olmal\u0131 (IT, g\u00fcvenlik veya e-posta y\u00f6neticisi).<\/li>\n<li><strong>De\u011fi\u015fiklik y\u00f6netimi uygulay\u0131n<\/strong>: SPF\/DKIM\/DMARC de\u011fi\u015fiklikleri i\u00e7in kay\u0131t tutun; \u201ck\u00fc\u00e7\u00fck DNS de\u011fi\u015fikli\u011fi\u201d b\u00fcy\u00fck kesintilere yol a\u00e7abilir.<\/li>\n<li><strong>Yeni sistem eklenince kontrol listesi \u00e7al\u0131\u015ft\u0131r\u0131n<\/strong>: Yeni bir SaaS arac\u0131 e-posta g\u00f6ndermeye ba\u015flad\u0131\u011f\u0131nda raporlarda hemen g\u00f6r\u00fcn\u00fcr; beklemeden do\u011frulay\u0131n.<\/li>\n<\/ul>\n<h2>Sonu\u00e7: DMARC raporlar\u0131 bir uyumluluk de\u011fil, bir g\u00f6r\u00fcn\u00fcrl\u00fck arac\u0131d\u0131r<\/h2>\n<p>DMARC raporlar\u0131 do\u011fru okundu\u011funda yaln\u0131zca sahtecili\u011fi azaltmakla kalmaz; \u015firketinizin e-posta g\u00f6nderim mimarisini g\u00f6r\u00fcn\u00fcr k\u0131lar, teslim edilebilirli\u011fi iyile\u015ftirir ve yetkisiz kaynaklar\u0131 erken yakalaman\u0131za yard\u0131m eder. D\u00fczenli rapor inceleme al\u0131\u015fkanl\u0131\u011f\u0131, e-posta altyap\u0131s\u0131nda yap\u0131lan de\u011fi\u015fikliklerin etkisini \u00f6l\u00e7menin de en g\u00fcvenilir yollar\u0131ndand\u0131r.<\/p>\n<p>MX1Mail \u00fczerinde alan ad\u0131n\u0131z\u0131 do\u011frulama (SPF\/DKIM\/DMARC) \u00e7al\u0131\u015fmalar\u0131n\u0131z\u0131 planlarken, rua raporlar\u0131ndan gelen bulgular\u0131 bir kontrol listesine d\u00f6n\u00fc\u015ft\u00fcrmek; ge\u00e7i\u015f ve sonras\u0131nda politikan\u0131z\u0131 g\u00fcvenle s\u0131k\u0131la\u015ft\u0131rman\u0131z\u0131 kolayla\u015ft\u0131r\u0131r.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>DMARC rua ve ruf raporlar\u0131n\u0131 pratik \u015fekilde yorumlay\u0131n: kim sizin ad\u0131n\u0131za mail g\u00f6nderiyor, SPF\/DKIM hizalamas\u0131 neden bozuluyor ve nas\u0131l d\u00fczeltirsiniz?<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[331,333,277],"class_list":["post-139","post","type-post","status-publish","format-standard","hentry","category-e-posta-guvenligi","tag-dmarc-raporlama","tag-spf-dkim","tag-teslim-edilebilirlik"],"_links":{"self":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/posts\/139","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/comments?post=139"}],"version-history":[{"count":0,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/posts\/139\/revisions"}],"wp:attachment":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/media?parent=139"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/categories?post=139"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/tags?post=139"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}