{"id":181,"date":"2026-10-22T09:01:20","date_gmt":"2026-10-22T06:01:20","guid":{"rendered":"https:\/\/mx1mail.com\/blog\/smtp-banner-ve-sunucu-parmak-izi-fingerprinting-sertlestirme\/"},"modified":"2026-10-22T09:01:20","modified_gmt":"2026-10-22T06:01:20","slug":"smtp-banner-ve-sunucu-parmak-izi-fingerprinting-sertlestirme","status":"publish","type":"post","link":"https:\/\/mx1mail.com\/blog\/tr\/smtp-banner-ve-sunucu-parmak-izi-fingerprinting-sertlestirme\/","title":{"rendered":"SMTP Banner ve Sunucu Parmak \u0130zi (Fingerprinting): \u201cESMTP Postfix\u201d Bilgisi Risk mi, Nas\u0131l Sertle\u015ftirilir?"},"content":{"rendered":"<h2>SMTP banner nedir ve nerede g\u00f6r\u00fcn\u00fcr?<\/h2>\n<p>SMTP banner, bir istemci (g\u00f6nderici MTA, test arac\u0131 veya e-posta g\u00fcvenlik gateway\u2019i) mail sunucunuza ba\u011fland\u0131\u011f\u0131nda sunucunun ilk yan\u0131t sat\u0131r\u0131d\u0131r. Genellikle 220 kodu ile ba\u015flar ve \u00e7o\u011fu yap\u0131land\u0131rmada sunucu ad\u0131 (hostname) ile birlikte yaz\u0131l\u0131m hakk\u0131nda ipucu veren bir metin i\u00e7erir. \u00d6rnek olarak \u201c220 mail.ornek.com ESMTP &#8230;\u201d gibi bir sat\u0131r g\u00f6r\u00fclebilir.<\/p>\n<p>Bu banner, \u00e7o\u011fu zaman bir \u201chata\u201d de\u011fil, protokol\u00fcn do\u011fal bir par\u00e7as\u0131d\u0131r. Ancak banner\u2019da gere\u011finden fazla bilgi (yaz\u0131l\u0131m ad\u0131, s\u00fcr\u00fcm, da\u011f\u0131t\u0131m, mod\u00fcl) bulunmas\u0131, d\u0131\u015far\u0131dan g\u00f6zlemleyen birinin altyap\u0131y\u0131 daha kolay tan\u0131mas\u0131na neden olabilir.<\/p>\n<h2>Banner fingerprinting (parmak izi) ne demektir?<\/h2>\n<p>Fingerprinting, hedef sistem hakk\u0131nda \u201cdo\u011frudan giri\u015f yapmadan\u201d m\u00fcmk\u00fcn oldu\u011funca \u00e7ok teknik bilgi toplamaya y\u00f6nelik ke\u015fif yakla\u015f\u0131m\u0131d\u0131r. E-posta taraf\u0131nda fingerprinting \u015fu kaynaklardan yap\u0131labilir:<\/p>\n<ul>\n<li>SMTP banner ve EHLO yan\u0131tlar\u0131<\/li>\n<li>TLS el s\u0131k\u0131\u015fmas\u0131 s\u0131ras\u0131nda sertifika\/anahtar \u00f6zellikleri<\/li>\n<li>Sunucunun destekledi\u011fi SMTP uzant\u0131lar\u0131 (SIZE, PIPELINING, AUTH mekanizmalar\u0131 gibi)<\/li>\n<li>Hata mesajlar\u0131n\u0131n ayr\u0131nt\u0131 d\u00fczeyi (5xx\/4xx metinleri)<\/li>\n<li>Header kal\u0131plar\u0131 (Received sat\u0131rlar\u0131, eklenen sistem header\u2019lar\u0131)<\/li>\n<\/ul>\n<p>Bu bilgiler tek ba\u015f\u0131na sisteminizi \u201ck\u0131rmaz\u201d. Fakat sald\u0131rgan\u0131n hedef se\u00e7imini kolayla\u015ft\u0131rabilir. \u00d6rne\u011fin belirli bir yaz\u0131l\u0131m\/s\u00fcr\u00fcm kombinasyonunda bilinen bir zafiyet arayan otomatik taray\u0131c\u0131lar, banner veya protokol davran\u0131\u015f\u0131 \u00fczerinden sizi aday listeye ekleyebilir.<\/p>\n<h2>\u201cESMTP Postfix\u201d gibi bir ifade ger\u00e7ekten risk midir?<\/h2>\n<p>Pratikte risk, banner\u2019da yaln\u0131zca yaz\u0131l\u0131m ad\u0131n\u0131n g\u00f6r\u00fcnmesinden \u00e7ok, \u015fu iki fakt\u00f6rle ilgilidir:<\/p>\n<ul>\n<li><strong>G\u00fcncellik ve yamalar:<\/strong> Sunucu yaz\u0131l\u0131m\u0131 g\u00fcncel de\u011filse, banner\u2019daki bilgi sald\u0131rgan\u0131n do\u011fru istismar\u0131 se\u00e7mesine yard\u0131mc\u0131 olur.<\/li>\n<li><strong>Ek ipu\u00e7lar\u0131 ve yanl\u0131\u015f yap\u0131land\u0131rma:<\/strong> Banner\u2019\u0131n s\u00fcr\u00fcm, da\u011f\u0131t\u0131m, i\u00e7 host ad\u0131, i\u00e7 a\u011f yap\u0131s\u0131 veya ortam bilgisi s\u0131zd\u0131rmas\u0131.<\/li>\n<\/ul>\n<p>Yani \u201cPostfix kullan\u0131yorum\u201d bilgisinin g\u00f6r\u00fcnmesi tek ba\u015f\u0131na felaket de\u011fildir; \u00e7\u00fcnk\u00fc \u00e7o\u011fu altyap\u0131 zaten protokol davran\u0131\u015f\u0131ndan bunu tahmin ettirebilir. Buna ra\u011fmen savunma yakla\u015f\u0131m\u0131nda \u201cgereksiz bilgi vermemek\u201d iyi bir ilkedir. Ama bu ilke, teslim edilebilirli\u011fi veya tan\u0131lama kolayl\u0131\u011f\u0131n\u0131 bozacak kadar ileri g\u00f6t\u00fcr\u00fclmemelidir.<\/p>\n<h2>Banner sertle\u015ftirme ne sa\u011flar, ne sa\u011flamaz?<\/h2>\n<h3>Sa\u011flayabilecekleri<\/h3>\n<ul>\n<li>Otomatik taramalarda hedef profilinizi daha az belirgin hale getirmek<\/li>\n<li>S\u00fcr\u00fcm\/da\u011f\u0131t\u0131m bilgisi s\u0131z\u0131nt\u0131s\u0131n\u0131 azaltmak<\/li>\n<li>Gereksiz detay i\u00e7eren hata metinlerini sadele\u015ftirmek<\/li>\n<\/ul>\n<h3>Sa\u011flamayacaklar\u0131<\/h3>\n<ul>\n<li>G\u00fcncel olmayan sistemleri \u201cg\u00fcvenli\u201d yapmaz<\/li>\n<li>Yanl\u0131\u015f yetkilendirme, zay\u0131f parola, a\u00e7\u0131k relay gibi kritik hatalar\u0131 \u00f6rtmez<\/li>\n<li>Spam\/abuse riskini tek ba\u015f\u0131na d\u00fc\u015f\u00fcrmez<\/li>\n<\/ul>\n<p>Banner sertle\u015ftirmeyi, yama y\u00f6netimi, eri\u015fim politikalar\u0131, kimlik do\u011frulama ve izleme ile birlikte ele almak gerekir.<\/p>\n<h2>Ne kadar gizlemek do\u011fru? Operasyon ve deliverability dengesini kurmak<\/h2>\n<p>Bir\u00e7ok ekip banner\u2019\u0131 \u00e7ok agresif bi\u00e7imde \u201canonimle\u015ftirmek\u201d ister. Ancak a\u015f\u0131r\u0131 gizleme iki t\u00fcr probleme yol a\u00e7abilir:<\/p>\n<ul>\n<li><strong>Operasyonel tan\u0131lama zorla\u015f\u0131r:<\/strong> D\u0131\u015f sistemlerle sorun ya\u015fand\u0131\u011f\u0131nda (TLS hatas\u0131, yanl\u0131\u015f y\u00f6nlendirme, rate limit vb.) h\u0131zl\u0131 te\u015fhis i\u00e7in sunucunun kendini tutarl\u0131 bi\u00e7imde tan\u0131tmas\u0131 yard\u0131mc\u0131 olur.<\/li>\n<li><strong>Uyumsuzluk \u015f\u00fcphesi:<\/strong> Baz\u0131 g\u00fcvenlik cihazlar\u0131, ola\u011fand\u0131\u015f\u0131 banner metinlerini veya tutars\u0131z hostname bilgilerini \u201canomali\u201d olarak i\u015faretleyebilir.<\/li>\n<\/ul>\n<p>\u0130yi yakla\u015f\u0131m, kurumsal kimli\u011finize uygun, minimum bilgi i\u00e7eren ama teknik olarak do\u011fru bir banner kullanmakt\u0131r. En \u00f6nemlisi, banner\u2019daki hostname ile DNS ve TLS sertifikas\u0131 gibi di\u011fer katmanlar\u0131n birbiriyle \u00e7eli\u015fmemesidir.<\/p>\n<h2>Pratik bir sertle\u015ftirme kontrol listesi<\/h2>\n<h3>1) Banner i\u00e7eri\u011fini sadele\u015ftirin<\/h3>\n<p>Banner sat\u0131r\u0131nda s\u00fcr\u00fcm numaras\u0131, i\u015fletim sistemi veya i\u00e7 a\u011f isimleri olmamal\u0131d\u0131r. \u201cmail.ornek.com ESMTP\u201d gibi k\u0131sa bir ifade \u00e7o\u011fu senaryoda yeterlidir. Banner\u2019da ger\u00e7ek FQDN kullanmak, baz\u0131 teslim edilebilirlik ve TLS uyumlulu\u011fu testlerinde daha tutarl\u0131 sonu\u00e7 verir.<\/p>\n<h3>2) EHLO yan\u0131t\u0131ndaki uzant\u0131lar\u0131 g\u00f6zden ge\u00e7irin<\/h3>\n<p>Sunucunun destekledi\u011fi uzant\u0131lar sald\u0131rgan\u0131n yetenek ke\u015ffi i\u00e7in kullan\u0131l\u0131r. Burada ama\u00e7 \u201cher \u015feyi kapatmak\u201d de\u011fil, ihtiyac\u0131n\u0131z olmayan\u0131 a\u00e7mamakt\u0131r. \u00d6rne\u011fin kullan\u0131c\u0131 istemcileri i\u00e7in SMTP submission ayr\u0131 bir hizmette y\u00f6netiliyorsa, internetten gelen ba\u011flant\u0131larda AUTH mekanizmalar\u0131n\u0131 yay\u0131nlamak gereksiz olabilir. Ancak bunu de\u011fi\u015ftirirken mimarinizi iyi ay\u0131rd\u0131\u011f\u0131n\u0131zdan emin olun.<\/p>\n<h3>3) Hata mesajlar\u0131n\u0131 bilgi s\u0131zd\u0131rmayacak \u015fekilde ayarlay\u0131n<\/h3>\n<p>\u201cUser unknown\u201d gibi net mesajlar operasyon i\u00e7in faydal\u0131 olsa da, baz\u0131 ortamlarda hesap enumerasyonu riskini art\u0131rabilir. Di\u011fer yandan \u00e7ok belirsiz hatalar helpdesk y\u00fck\u00fcn\u00fc art\u0131rabilir. Denge, kurulu\u015fun tehdit modeline g\u00f6re kurulmal\u0131d\u0131r.<\/p>\n<h3>4) TLS yap\u0131land\u0131rmas\u0131n\u0131 tutarl\u0131 hale getirin<\/h3>\n<p>Banner metnini de\u011fi\u015ftirmekten daha \u00f6nemli olan, TLS\u2019in do\u011fru sunulmas\u0131d\u0131r. Sertifikan\u0131n CN\/SAN alanlar\u0131 kullan\u0131lan FQDN ile uyumlu olmal\u0131, zincir eksiksiz olmal\u0131 ve modern \u015fifre k\u00fcmeleri tercih edilmelidir. Ayr\u0131ca MTA-STS gibi mekanizmalar kullan\u0131l\u0131yorsa, bu politika ile ger\u00e7ek davran\u0131\u015f\u0131n\u0131z tutarl\u0131 olmal\u0131d\u0131r.<\/p>\n<h3>5) DNS ve isimlendirmeyi d\u00fczeltin<\/h3>\n<p>\u0130\u00e7 hostname\u2019lerin d\u0131\u015far\u0131 s\u0131zmas\u0131 s\u0131k g\u00f6r\u00fclen bir hatad\u0131r. Sunucunun kendini tan\u0131tt\u0131\u011f\u0131 isim, genel DNS\u2019te \u00e7\u00f6z\u00fcmlenebilir olmal\u0131 ve ters DNS (PTR) ile \u00e7eli\u015fmemelidir. Bu yaln\u0131zca g\u00fcvenlik de\u011fil, teslim edilebilirlik a\u00e7\u0131s\u0131ndan da \u00f6nem ta\u015f\u0131r.<\/p>\n<h3>6) G\u00fcncelleme ve zafiyet y\u00f6netimi birincil \u00f6ncelik olmal\u0131<\/h3>\n<p>Banner gizlemek, yamalanmam\u0131\u015f bir sistemi kurtarmaz. D\u00fczenli g\u00fcncellemeler, gereksiz servislerin kapat\u0131lmas\u0131, y\u00f6netim panellerinin internete kapal\u0131 tutulmas\u0131 ve eri\u015fim kontrol\u00fc gibi ad\u0131mlar daha y\u00fcksek etki sa\u011flar.<\/p>\n<h3>7) Loglama ve uyar\u0131 mekanizmalar\u0131 kurun<\/h3>\n<p>Banner fingerprinting genellikle geni\u015f taramalarla ba\u015flar. Ba\u011flant\u0131 denemeleri, ba\u015far\u0131s\u0131z AUTH giri\u015fimleri, s\u0131ra d\u0131\u015f\u0131 komut dizileri ve \u00e7oklu hedeften gelen denemeler izlenmeli; anomali art\u0131\u015f\u0131nda aksiyon al\u0131nmal\u0131d\u0131r.<\/p>\n<h2>Yayg\u0131n hatalar<\/h2>\n<ul>\n<li><strong>Hostname tutars\u0131zl\u0131\u011f\u0131:<\/strong> Banner\u2019daki isim, sertifikadaki isim ve PTR kayd\u0131 farkl\u0131 olunca hem g\u00fcven hem de sorun giderme zorla\u015f\u0131r.<\/li>\n<li><strong>Submission ve inbound\u2019u kar\u0131\u015ft\u0131rmak:<\/strong> \u0130nternetten gelen SMTP (25) ile kullan\u0131c\u0131lar\u0131n g\u00f6nderimi (587\/465) ayn\u0131 politikaya zorland\u0131\u011f\u0131nda ya g\u00fcvenlik a\u00e7\u0131\u011f\u0131 olu\u015fur ya da kullan\u0131c\u0131 deneyimi bozulur.<\/li>\n<li><strong>\u201cSecurity by obscurity\u201de a\u015f\u0131r\u0131 g\u00fcven:<\/strong> Banner\u2019\u0131 saklay\u0131p yama y\u00f6netimini ihmal etmek en tehlikeli senaryodur.<\/li>\n<\/ul>\n<h2>De\u011fi\u015fiklikleri nas\u0131l g\u00fcvenle uygulamal\u0131s\u0131n\u0131z?<\/h2>\n<p>Banner ve ilgili protokol davran\u0131\u015f\u0131n\u0131 de\u011fi\u015ftirmek k\u00fc\u00e7\u00fck bir ayar gibi g\u00f6r\u00fcnse de, \u00fcretim ortam\u0131nda kontroll\u00fc ilerlemek gerekir:<\/p>\n<ol>\n<li>Mevcut durumu kaydedin: banner, EHLO \u00e7\u0131kt\u0131s\u0131, TLS test sonu\u00e7lar\u0131, temel ak\u0131\u015f metrikleri.<\/li>\n<li>De\u011fi\u015fikli\u011fi k\u00fc\u00e7\u00fck bir kapsamda deneyin (m\u00fcmk\u00fcnse test\/ikincil sunucu).<\/li>\n<li>Gelen\/giden ak\u0131\u015fta hata oranlar\u0131n\u0131 ve gecikmeleri izleyin.<\/li>\n<li>Sorun olursa h\u0131zl\u0131 geri d\u00f6n\u00fc\u015f i\u00e7in eski ayar\u0131 dok\u00fcmante edin.<\/li>\n<\/ol>\n<p>Bu yakla\u015f\u0131m, hem g\u00fcvenlik hedefinizi hem de teslim edilebilirlik stabilitenizi koruman\u0131za yard\u0131mc\u0131 olur.<\/p>\n<h2>Sonu\u00e7: Daha az bilgi, daha \u00e7ok dayan\u0131kl\u0131l\u0131k<\/h2>\n<p>SMTP banner fingerprinting, e-posta altyap\u0131s\u0131nda s\u0131k kullan\u0131lan bir ke\u015fif y\u00f6ntemidir. Banner\u2019\u0131 sadele\u015ftirmek ve gereksiz ayr\u0131nt\u0131lar\u0131 kald\u0131rmak mant\u0131kl\u0131d\u0131r; ancak as\u0131l kazan\u0131m, tutarl\u0131 DNS\/TLS yap\u0131land\u0131rmas\u0131, do\u011fru rol ayr\u0131m\u0131 (inbound vs submission), g\u00fcncel yaz\u0131l\u0131m ve izleme ile gelir.<\/p>\n<p>MX1Mail gibi kurumsal e-posta hizmetlerinde de benzer prensip ge\u00e7erlidir: ama\u00e7, e-posta ak\u0131\u015f\u0131n\u0131 bozmayacak \u015fekilde gereksiz bilgi s\u0131z\u0131nt\u0131s\u0131n\u0131 azaltmak ve operasyonel g\u00f6r\u00fcn\u00fcrl\u00fc\u011f\u00fc koruyarak g\u00fcvenli\u011fi art\u0131rmakt\u0131r. Kendi alan ad\u0131n\u0131z ve e-posta altyap\u0131n\u0131z i\u00e7in banner sertle\u015ftirmeyi, daha geni\u015f bir g\u00fcvenlik ve deliverability kontrol listesinin par\u00e7as\u0131 olarak ele al\u0131n.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>SMTP banner bilgisi sald\u0131rganlara ipucu verebilir. Banner fingerprinting nedir, riskleri nelerdir ve kurumsal mail altyap\u0131s\u0131nda nas\u0131l dengeli \u015fekilde sertle\u015ftirme yap\u0131l\u0131r?<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[480,478,437],"class_list":["post-181","post","type-post","status-publish","format-standard","hentry","category-e-posta-guvenligi","tag-fingerprinting","tag-mail-sunucusu-sertlestirme","tag-smtp-guvenligi"],"_links":{"self":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/posts\/181","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/comments?post=181"}],"version-history":[{"count":0,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/posts\/181\/revisions"}],"wp:attachment":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/media?parent=181"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/categories?post=181"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/tags?post=181"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}