{"id":159,"date":"2026-10-16T17:01:29","date_gmt":"2026-10-16T14:01:29","guid":{"rendered":"https:\/\/mx1mail.com\/blog\/domain-lockdown-nedir-e-posta-guvenligi-registrar-dns\/"},"modified":"2026-10-16T17:01:29","modified_gmt":"2026-10-16T14:01:29","slug":"domain-lockdown-nedir-e-posta-guvenligi-registrar-dns","status":"publish","type":"post","link":"https:\/\/mx1mail.com\/blog\/tr\/domain-lockdown-nedir-e-posta-guvenligi-registrar-dns\/","title":{"rendered":"Domain Lockdown (Kilit) Nedir? E-Posta G\u00fcvenli\u011fi \u0130\u00e7in Registrar ve DNS \u00dczerinde Do\u011fru Uygulama"},"content":{"rendered":"<h2>Domain neden e-posta altyap\u0131s\u0131n\u0131n en kritik par\u00e7as\u0131d\u0131r?<\/h2>\n<p>Kurumsal e-posta s\u00f6z konusu oldu\u011funda \u00e7o\u011fu ekip oda\u011f\u0131n\u0131 spam filtreleri, kimlik do\u011frulama (SPF\/DKIM\/DMARC) veya kullan\u0131c\u0131 parolalar\u0131 gibi konulara verir. Oysa bir \u015firketin alan ad\u0131 (domain) kay\u0131tlar\u0131n\u0131n ele ge\u00e7irilmesi ya da yetkisiz de\u011fi\u015ftirilmesi, e-postan\u0131n \u00e7al\u0131\u015fmas\u0131n\u0131 birka\u00e7 dakika i\u00e7inde tamamen bozabilir. \u00c7\u00fcnk\u00fc e-postan\u0131n y\u00f6n\u00fc DNS ile belirlenir: MX kay\u0131tlar\u0131 gelen e-postan\u0131n nereye teslim edilece\u011fini, SPF g\u00f6nderen kaynaklar\u0131n yetkisini, DKIM imzalar\u0131n\u0131n do\u011frulanaca\u011f\u0131 anahtarlar\u0131, DMARC ise kimlik do\u011frulama politikas\u0131n\u0131 tan\u0131mlar.<\/p>\n<p>Domain Lockdown (domain kilidi) yakla\u015f\u0131m\u0131; registrar hesab\u0131n\u0131z\u0131, DNS y\u00f6netiminizi ve de\u011fi\u015fiklik s\u00fcre\u00e7lerinizi s\u0131k\u0131la\u015ft\u0131rarak alan ad\u0131n\u0131z\u0131n yetkisiz transfer, kay\u0131t de\u011fi\u015fikli\u011fi veya DNS sabotaj\u0131 gibi senaryolara kar\u015f\u0131 dayan\u0131kl\u0131l\u0131\u011f\u0131n\u0131 art\u0131rmay\u0131 hedefler. Bu yaz\u0131da, e-postayla do\u011frudan ili\u015fkili alan ad\u0131 g\u00fcvenli\u011fi ad\u0131mlar\u0131n\u0131 pratik bir \u00e7er\u00e7evede ele alaca\u011f\u0131z.<\/p>\n<h2>Domain Lockdown tam olarak neyi kapsar?<\/h2>\n<p>Domain kilidi tek bir ayar de\u011fildir; birden fazla kontrol\u00fcn birlikte uygulanmas\u0131d\u0131r. Temel bile\u015fenler \u015funlard\u0131r:<\/p>\n<ul>\n<li><strong>Registrar taraf\u0131 korumalar\u0131:<\/strong> Domain transfer kilidi, hesap g\u00fcvenli\u011fi, ileti\u015fim bilgileri korumas\u0131, kritik i\u015flem onaylar\u0131.<\/li>\n<li><strong>DNS kontrol\u00fc:<\/strong> DNS bar\u0131nd\u0131rma hesab\u0131na eri\u015fim, de\u011fi\u015fiklik yetkileri, kay\u0131t de\u011fi\u015fikli\u011fi izleme ve geri d\u00f6n\u00fc\u015f plan\u0131.<\/li>\n<li><strong>Operasyonel s\u00fcre\u00e7ler:<\/strong> Kim, ne zaman, hangi kay\u0131tlar\u0131 de\u011fi\u015ftirebilir; de\u011fi\u015fiklikler nas\u0131l test edilir; acil durumda ne yap\u0131l\u0131r.<\/li>\n<\/ul>\n<h2>Tehdit modeli: Domain ele ge\u00e7irilirse e-postada ne olur?<\/h2>\n<p>Ger\u00e7ek\u00e7i bir risk de\u011ferlendirmesi i\u00e7in, sald\u0131rgan\u0131n DNS \u00fczerinde neler yapabilece\u011fini d\u00fc\u015f\u00fcnmek gerekir. En yayg\u0131n senaryolar:<\/p>\n<ul>\n<li><strong>MX kay\u0131tlar\u0131n\u0131 de\u011fi\u015ftirmek:<\/strong> Gelen e-postalar sald\u0131rgan\u0131n kontrol etti\u011fi sunucuya y\u00f6nlenebilir veya tamamen kesintiye u\u011frayabilir.<\/li>\n<li><strong>SPF kayd\u0131n\u0131 gev\u015fetmek:<\/strong> Sald\u0131rgan kendi IP\u2019lerini\/servislerini \u201cyetkili g\u00f6nderici\u201d gibi g\u00f6sterebilir.<\/li>\n<li><strong>DKIM anahtarlar\u0131n\u0131 de\u011fi\u015ftirmek:<\/strong> Sahte e-postalar ge\u00e7erli imzal\u0131 gibi g\u00f6r\u00fcnebilir ya da me\u015fru e-postalar do\u011frulanamaz hale gelerek teslimat sorunlar\u0131 ya\u015far.<\/li>\n<li><strong>DMARC politikas\u0131n\u0131 d\u00fc\u015f\u00fcrmek:<\/strong> p=reject yerine p=none yap\u0131lmas\u0131, sahtecili\u011fe kar\u015f\u0131 korumay\u0131 zay\u0131flatabilir.<\/li>\n<li><strong>Autodiscover\/benzeri kay\u0131tlar:<\/strong> Kullan\u0131c\u0131lar\u0131n istemci otomatik yap\u0131land\u0131rmas\u0131 yanl\u0131\u015f yerlere y\u00f6nlenebilir ve kimlik av\u0131 riskini art\u0131rabilir.<\/li>\n<\/ul>\n<p>\u00d6zetle domain g\u00fcvenli\u011fi; yaln\u0131zca web siteniz i\u00e7in de\u011fil, finans, sat\u0131\u015f ve destek gibi t\u00fcm e-posta trafi\u011finiz i\u00e7in bir \u201ck\u00f6k g\u00fcven\u201d katman\u0131d\u0131r.<\/p>\n<h2>Registrar g\u00fcvenli\u011fi: Kilit, 2FA ve hesap hijyeni<\/h2>\n<h3>Transfer kilidi (Registrar lock) ve yetkisiz transfer riski<\/h3>\n<p>Bir\u00e7ok registrar, domainin ba\u015fka bir kuruma ta\u015f\u0131nmas\u0131n\u0131 \u00f6nleyen \u201ctransfer kilidi\u201d se\u00e7ene\u011fi sunar. Bu kilit a\u00e7\u0131kken domain transferi yapmak isterseniz \u00f6nce kilidi kald\u0131rman\u0131z gerekir. Bu, sald\u0131rgan\u0131n hesab\u0131n\u0131za k\u0131smi eri\u015fim sa\u011flasa bile domaini h\u0131zl\u0131ca ka\u00e7\u0131rmas\u0131n\u0131 zorla\u015ft\u0131r\u0131r.<\/p>\n<h3>2FA ve kurtarma mekanizmalar\u0131<\/h3>\n<p>Registrar hesab\u0131nda iki fakt\u00f6rl\u00fc do\u011frulama (2FA) etkin olmal\u0131d\u0131r. Sadece etkinle\u015ftirmek yetmez; kurtarma se\u00e7enekleri de g\u00fcvenli olmal\u0131d\u0131r. Ortak e-posta kutular\u0131na ba\u011fl\u0131 kurtarma adresleri, eski telefon numaralar\u0131 veya \u00e7ok ki\u015finin eri\u015fti\u011fi SMS hatlar\u0131 risk yarat\u0131r. M\u00fcmk\u00fcnse kurumsal kimlik y\u00f6netimi ilkeleriyle uyumlu, sorumlu ki\u015filerin kontrol etti\u011fi bir 2FA y\u00f6ntemi se\u00e7ilmelidir.<\/p>\n<h3>Hesap sahipli\u011fi ve eri\u015fim prensipleri<\/h3>\n<p>Registrar hesab\u0131 \u201ctek ki\u015fide\u201d olmamal\u0131; ancak \u201cherkeste\u201d de olmamal\u0131d\u0131r. En iyi yakla\u015f\u0131m, az say\u0131da yetkili kullan\u0131c\u0131, rol bazl\u0131 eri\u015fim ve de\u011fi\u015fiklik kayd\u0131 tutmakt\u0131r. Ayr\u0131lan \u00e7al\u0131\u015fanlar\u0131n eri\u015fimlerinin kald\u0131r\u0131lmas\u0131 ve kay\u0131tl\u0131 ileti\u015fim bilgilerinin g\u00fcncel tutulmas\u0131 operasyonel bir zorunluluktur.<\/p>\n<h2>DNS bar\u0131nd\u0131rma g\u00fcvenli\u011fi: Eri\u015fim, yetki ve izlenebilirlik<\/h2>\n<h3>DNS nerede y\u00f6netiliyor?<\/h3>\n<p>Domain registrar ile DNS bar\u0131nd\u0131rma ayn\u0131 yerde olabilir veya farkl\u0131 sa\u011flay\u0131c\u0131larda bulunabilir. Kritik olan; DNS\u2019i y\u00f6neten hesab\u0131n g\u00fcvenlik d\u00fczeyi ve s\u00fcre\u00e7lerinin net olmas\u0131d\u0131r. DNS de\u011fi\u015fikli\u011fi yapabilen her hesap, e-postan\u0131n kaderini etkiler.<\/p>\n<h3>En az ayr\u0131cal\u0131k (least privilege) ve de\u011fi\u015fiklik rolleri<\/h3>\n<p>DNS paneline eri\u015fimi olan herkesin t\u00fcm kay\u0131tlar\u0131 de\u011fi\u015ftirebilmesi ciddi bir risktir. M\u00fcmk\u00fcnse yetkiler; sadece gerekli ki\u015filere, gerekli kapsamla verilmelidir. \u00d6rne\u011fin bir ekip web kay\u0131tlar\u0131n\u0131 y\u00f6netirken (A\/AAAA\/CNAME), e-posta kay\u0131tlar\u0131 (MX, SPF, DKIM, DMARC) ayr\u0131 bir onay s\u00fcrecine tabi olabilir.<\/p>\n<h3>De\u011fi\u015fiklik g\u00fcnl\u00fc\u011f\u00fc ve alarm yakla\u015f\u0131m\u0131<\/h3>\n<p>DNS de\u011fi\u015fiklikleri i\u00e7in kimin ne yapt\u0131\u011f\u0131n\u0131 g\u00f6steren bir kay\u0131t (audit log) \u00e7ok de\u011ferlidir. Ek olarak, kritik kay\u0131tlarda bir de\u011fi\u015fiklik oldu\u011funda sorumlu ekibe bildirim gidecek bir izleme yakla\u015f\u0131m\u0131 operasyonel g\u00fcvenli\u011fi art\u0131r\u0131r. En az\u0131ndan periyodik kontrol ve \u201cbeklenen kay\u0131tlar listesi\u201d ile k\u0131yaslama yap\u0131lmal\u0131d\u0131r.<\/p>\n<h2>E-posta ile ili\u015fkili kritik DNS kay\u0131tlar\u0131n\u0131 kilitleme yakla\u015f\u0131m\u0131<\/h2>\n<h3>MX kay\u0131tlar\u0131: Kesinti ve y\u00f6nlendirme riskinin merkezi<\/h3>\n<p>MX kay\u0131tlar\u0131, gelen e-postalar\u0131n teslim edilece\u011fi sunucular\u0131 tan\u0131mlar. Yetkisiz de\u011fi\u015fikliklerde iki risk ortaya \u00e7\u0131kar: e-postalar\u0131n \u00e7al\u0131nmas\u0131 (k\u00f6t\u00fc niyetli sunucuya y\u00f6nlenme) ve i\u015f s\u00fcreklili\u011fi kayb\u0131 (gelen e-posta ak\u0131\u015f\u0131n\u0131n durmas\u0131). MX kay\u0131tlar\u0131n\u0131z\u0131n \u201cbeklenen de\u011ferleri\u201d dok\u00fcmante edilmeli ve acil durumda h\u0131zl\u0131 geri d\u00f6n\u00fc\u015f i\u00e7in haz\u0131r tutulmal\u0131d\u0131r.<\/p>\n<h3>SPF: Yetkisiz g\u00f6nderenlere kap\u0131 a\u00e7may\u0131n<\/h3>\n<p>SPF kayd\u0131, hangi sunucular\u0131n alan ad\u0131n\u0131z ad\u0131na e-posta g\u00f6nderebilece\u011fini belirtir. Sald\u0131rgan\u0131n SPF\u2019i gev\u015fetmesi, sahte e-postalar\u0131n al\u0131c\u0131 taraf\u0131nda daha az \u015f\u00fcpheli g\u00f6r\u00fcnmesine yol a\u00e7abilir. SPF de\u011fi\u015fiklikleri; yeni g\u00f6nderici kayna\u011f\u0131 devreye al\u0131rken kontroll\u00fc yap\u0131lmal\u0131, gereksiz include\/IP tan\u0131mlar\u0131 temizlenmelidir.<\/p>\n<h3>DKIM: \u0130mza anahtarlar\u0131 kontrol alt\u0131nda olmal\u0131<\/h3>\n<p>DKIM, e-postalar\u0131n de\u011fi\u015fmedi\u011fini ve alan ad\u0131n\u0131zla ili\u015fkili bir imza ta\u015f\u0131d\u0131\u011f\u0131n\u0131 g\u00f6sterir. DNS\u2019teki DKIM public key kay\u0131tlar\u0131 de\u011fi\u015ftirilirse, me\u015fru g\u00f6nderimler do\u011frulanamayabilir veya sald\u0131rgan kendi imzas\u0131n\u0131 \u201cme\u015fru\u201d gibi g\u00f6sterebilir. DKIM selector\u2019lar\u0131, anahtar rotasyonu ve kay\u0131tlar\u0131n b\u00fct\u00fcnl\u00fc\u011f\u00fc i\u00e7in de\u011fi\u015fiklik s\u00fcreci s\u0131k\u0131 tutulmal\u0131d\u0131r.<\/p>\n<h3>DMARC: Politika d\u00fc\u015f\u00fcrme sald\u0131r\u0131lar\u0131n\u0131 g\u00f6zden ka\u00e7\u0131rmay\u0131n<\/h3>\n<p>DMARC, kimlik do\u011frulama ba\u015far\u0131s\u0131z oldu\u011funda al\u0131c\u0131n\u0131n nas\u0131l davranaca\u011f\u0131n\u0131 belirleyen politikad\u0131r. Yetkisiz bir p=none de\u011fi\u015fikli\u011fi, g\u00f6r\u00fcn\u00fcrde e-postay\u0131 bozmaz; bu y\u00fczden fark edilmesi gecikebilir. DMARC kayd\u0131n\u0131z\u0131n beklenen policy\/pct de\u011ferleri izlenmeli, raporlar\u0131n gitti\u011fi adresler (rua) da korunmal\u0131d\u0131r.<\/p>\n<h2>Operasyonel kontrol listesi: De\u011fi\u015fiklikleri g\u00fcvenle y\u00f6netme<\/h2>\n<p>Teknik kontroller kadar s\u00fcre\u00e7 de \u00f6nemlidir. A\u015fa\u011f\u0131daki pratik liste, e-posta DNS de\u011fi\u015fiklikleri ve domain g\u00fcvenli\u011fi i\u00e7in temel bir \u00e7er\u00e7eve sa\u011flar:<\/p>\n<ol>\n<li><strong>Varl\u0131k envanteri \u00e7\u0131kar\u0131n:<\/strong> Domainler, DNS bar\u0131nd\u0131rma hesaplar\u0131, registrar hesaplar\u0131, yetkili ki\u015filer.<\/li>\n<li><strong>Kritik kay\u0131tlar\u0131n \u201calt\u0131n kopyas\u0131n\u0131\u201d tutun:<\/strong> MX, SPF, DKIM selector\u2019lar\u0131, DMARC, MTA-STS\/TLS-RPT varsa ilgili kay\u0131tlar.<\/li>\n<li><strong>De\u011fi\u015fiklik onay\u0131 belirleyin:<\/strong> E-posta ile ilgili kay\u0131tlar en az iki ki\u015finin g\u00f6z\u00fcnden ge\u00e7sin.<\/li>\n<li><strong>TTL ve yay\u0131l\u0131m\u0131 hesaba kat\u0131n:<\/strong> De\u011fi\u015fikliklerin ne zaman etkili olaca\u011f\u0131n\u0131 planlay\u0131n; geri d\u00f6n\u00fc\u015f i\u00e7in s\u00fcre b\u0131rak\u0131n.<\/li>\n<li><strong>Geri d\u00f6n\u00fc\u015f plan\u0131 haz\u0131rlay\u0131n:<\/strong> Hatal\u0131 de\u011fi\u015fiklikte hangi kay\u0131tlar eski haline d\u00f6necek, kim uygulayacak, hangi s\u0131rayla yap\u0131lacak.<\/li>\n<li><strong>\u015e\u00fcpheli de\u011fi\u015fiklik prosed\u00fcr\u00fc olu\u015fturun:<\/strong> Beklenmeyen bir DNS de\u011fi\u015fikli\u011fi g\u00f6r\u00fcl\u00fcrse \u00f6nce hesap g\u00fcvenli\u011fi, sonra DNS geri d\u00f6n\u00fc\u015f ve son olarak e-posta ak\u0131\u015f\u0131 do\u011frulamas\u0131 yap\u0131lmal\u0131.<\/li>\n<\/ol>\n<h2>Domain Lockdown ile teslim edilebilirlik ve i\u015f s\u00fcreklili\u011fi ili\u015fkisi<\/h2>\n<p>Alan ad\u0131 g\u00fcvenli\u011fi sadece \u201chack\u201d riskini azaltmakla kalmaz; teslim edilebilirlik ve s\u00fcreklilik a\u00e7\u0131s\u0131ndan da koruyucudur. \u00d6rne\u011fin yanl\u0131\u015fl\u0131kla yap\u0131lan bir SPF\/DKIM de\u011fi\u015fikli\u011fi, e-postalar\u0131n\u0131z\u0131n spam\u2019e d\u00fc\u015fmesine neden olabilir. MX kayd\u0131 hatas\u0131 ise do\u011frudan kesinti yarat\u0131r. Domain Lockdown yakla\u015f\u0131m\u0131, bu hatalar\u0131n hem olas\u0131l\u0131\u011f\u0131n\u0131 hem de etkisini azalt\u0131r: daha az ki\u015fi de\u011fi\u015fiklik yapar, de\u011fi\u015fiklikler izlenir ve geri d\u00f6n\u00fc\u015f h\u0131zl\u0131 olur.<\/p>\n<h2>Sonu\u00e7: E-postay\u0131 korumak i\u00e7in domaini kilitleyin<\/h2>\n<p>Kurumsal e-posta g\u00fcvenli\u011fi, sadece kullan\u0131c\u0131 e\u011fitiminden veya g\u00fc\u00e7l\u00fc parolalardan ibaret de\u011fildir. Alan ad\u0131n\u0131z ve DNS y\u00f6netiminiz, e-posta altyap\u0131n\u0131z\u0131n kontrol merkezidir. Registrar g\u00fcvenli\u011fi, DNS eri\u015fim kontrol\u00fc ve iyi bir de\u011fi\u015fiklik y\u00f6netimi birlikte uyguland\u0131\u011f\u0131nda; hem yetkisiz m\u00fcdahalelere kar\u015f\u0131 dayan\u0131kl\u0131l\u0131k artar hem de yanl\u0131\u015f yap\u0131land\u0131rma kaynakl\u0131 kesintiler azal\u0131r.<\/p>\n<p>MX1Mail gibi kurumsal e-posta hizmeti kullan\u0131rken de bu temel prensipler ge\u00e7erlidir: E-posta hizmeti ne kadar sa\u011flam olursa olsun, alan ad\u0131n\u0131z\u0131n DNS kay\u0131tlar\u0131 do\u011fru ve g\u00fcvenli y\u00f6netilmedi\u011finde risk olu\u015fur. Bu nedenle domain kilidi yakla\u015f\u0131m\u0131n\u0131 bir kere kurup, d\u00fczenli aral\u0131klarla g\u00f6zden ge\u00e7irmek uzun vadede en pratik yat\u0131r\u0131md\u0131r.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>Domain ele ge\u00e7irme riskini azaltmak i\u00e7in registrar kilidi, DNS de\u011fi\u015fiklik kontrolleri ve e-posta ile ili\u015fkili kritik kay\u0131tlar (MX, SPF, DKIM, DMARC) i\u00e7in pratik bir g\u00fcvenlik rehberi.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[301,401,381],"class_list":["post-159","post","type-post","status-publish","format-standard","hentry","category-e-posta-guvenligi","tag-dns-yonetimi","tag-domain-guvenligi","tag-eposta-altyapisi"],"_links":{"self":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/posts\/159","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/comments?post=159"}],"version-history":[{"count":0,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/posts\/159\/revisions"}],"wp:attachment":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/media?parent=159"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/categories?post=159"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/tags?post=159"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}