{"id":183,"date":"2026-10-22T17:01:49","date_gmt":"2026-10-22T14:01:49","guid":{"rendered":"https:\/\/mx1mail.com\/blog\/dane-for-smtp-tlsa-nedir-dnssec-ile-tls-dogrulama\/"},"modified":"2026-10-22T17:01:49","modified_gmt":"2026-10-22T14:01:49","slug":"dane-for-smtp-tlsa-nedir-dnssec-ile-tls-dogrulama","status":"publish","type":"post","link":"https:\/\/mx1mail.com\/blog\/tr\/dane-for-smtp-tlsa-nedir-dnssec-ile-tls-dogrulama\/","title":{"rendered":"DANE for SMTP (TLSA) Nedir? Mail Sunucular\u0131nda TLS\u2019i DNSSEC ile Do\u011frulama ve G\u00fcvenli Kurulum Yakla\u015f\u0131m\u0131"},"content":{"rendered":"<h2>DANE for SMTP (TLSA) neyi \u00e7\u00f6zer?<\/h2>\n<p>E-posta iletimi genellikle SMTP \u00fczerinden yap\u0131l\u0131r ve iki sunucu aras\u0131nda TLS (STARTTLS) ile \u015fifreleme m\u00fcmk\u00fcn olsa da, pratikte en b\u00fcy\u00fck tart\u0131\u015fma noktas\u0131 \u201ckar\u015f\u0131 taraf\u0131n sertifikas\u0131na ne kadar g\u00fcveniyoruz?\u201d sorusudur. Klasik modelde al\u0131c\u0131 veya g\u00f6nderici MTA, sunucunun sundu\u011fu TLS sertifikas\u0131n\u0131 genel sertifika otoriteleri (CA) zinciri \u00fczerinden do\u011frular. Bu yakla\u015f\u0131m \u00e7o\u011fu senaryoda yeterli olsa da, yanl\u0131\u015f sertifika verilmesi, araya girme giri\u015fimleri, yanl\u0131\u015f yap\u0131land\u0131rmalar veya sald\u0131rgan\u0131n DNS yan\u0131tlar\u0131n\u0131 manip\u00fcle etti\u011fi durumlar gibi risklerin tamam\u0131 CA tabanl\u0131 g\u00fcven modelinin d\u0131\u015f\u0131nda farkl\u0131 kontrol noktalar\u0131 gerektirir.<\/p>\n<p><strong>DANE for SMTP<\/strong>, TLS sertifikas\u0131 do\u011frulamas\u0131n\u0131 DNSSEC ile korunan DNS kay\u0131tlar\u0131na ta\u015f\u0131yarak, hedef alan ad\u0131n\u0131n \u201changi sertifikay\u0131 veya hangi anahtar\u0131 kabul ediyorum\u201d bilgisini do\u011frulanabilir \u015fekilde ilan etmesine imk\u00e2n verir. Bu ilan <strong>TLSA<\/strong> kayd\u0131 ile yap\u0131l\u0131r. K\u0131saca DANE, SMTP seviyesinde TLS\u2019in yaln\u0131zca \u201cvar olmas\u0131n\u0131\u201d de\u011fil, hangi sertifikan\u0131n do\u011fru oldu\u011funu da daha s\u0131k\u0131 bir \u015fekilde belirlemeyi hedefler.<\/p>\n<h2>\u00d6n ko\u015fullar: DNSSEC ve do\u011fru isimlendirme<\/h2>\n<p>DANE\u2019in temel \u015fart\u0131, TLSA kayd\u0131n\u0131n DNSSEC ile imzalanm\u0131\u015f bir b\u00f6lgede bulunmas\u0131d\u0131r. DNSSEC yoksa, TLSA kayd\u0131 sald\u0131rgan taraf\u0131ndan sahte DNS yan\u0131tlar\u0131yla de\u011fi\u015ftirilebilir ve g\u00fcven kazanc\u0131 tersine d\u00f6nebilir. Bu nedenle DANE plan\u0131na ba\u015flamadan \u00f6nce a\u015fa\u011f\u0131daki konular netle\u015fmelidir:<\/p>\n<ul>\n<li><strong>Alan ad\u0131n\u0131z DNSSEC imzal\u0131 m\u0131?<\/strong> DNS sa\u011flay\u0131c\u0131n\u0131zda zone signing ve DS kayd\u0131 yay\u0131nlama s\u00fcreci tamamlanm\u0131\u015f olmal\u0131d\u0131r.<\/li>\n<li><strong>MX hedefleri belirgin mi?<\/strong> DANE kay\u0131tlar\u0131 genellikle MX\u2019in i\u015faret etti\u011fi host isimleri i\u00e7in tan\u0131mlan\u0131r. Da\u011f\u0131n\u0131k, s\u0131k de\u011fi\u015fen veya \u00fc\u00e7\u00fcnc\u00fc taraflara y\u00f6nlenen MX tasar\u0131mlar\u0131nda operasyon zorlu\u011fu artar.<\/li>\n<li><strong>Sunucu FQDN ve sertifika uyumu<\/strong>: SMTP sunucunuzun TLS sertifikas\u0131nda do\u011fru isim(ler) bulunmal\u0131 ve sunucunun sundu\u011fu kimlik beklenen FQDN ile tutarl\u0131 olmal\u0131d\u0131r.<\/li>\n<\/ul>\n<p>DANE\u2019e ge\u00e7i\u015f, \u201cDNS\u2019e bir kay\u0131t ekledim bitti\u201d seviyesinde de\u011fildir. DNSSEC\u2019in anahtar y\u00f6netimi, sa\u011flay\u0131c\u0131 de\u011fi\u015fikli\u011fi s\u00fcre\u00e7leri ve hata durumunda geri d\u00f6n\u00fc\u015f plan\u0131 mutlaka de\u011ferlendirilmelidir.<\/p>\n<h2>TLSA kayd\u0131 mant\u0131\u011f\u0131: usage, selector, matching type<\/h2>\n<p>TLSA kayd\u0131 d\u00f6rt par\u00e7al\u0131 bir mant\u0131kla \u00e7al\u0131\u015f\u0131r: port\/protokol\/host i\u00e7in bir kay\u0131t yay\u0131nlan\u0131r ve bu kay\u0131tta sertifika veya anahtar parmak izi belirtilir. SMTP taraf\u0131nda yayg\u0131n kullan\u0131m, 25 numaral\u0131 port \u00fczerindeki STARTTLS (TCP) i\u00e7indir.<\/p>\n<p>TLSA parametreleri \u00f6zetle \u015f\u00f6yledir:<\/p>\n<ul>\n<li><strong>Usage<\/strong>: Do\u011frulaman\u0131n CA zinciriyle mi, yoksa do\u011frudan DNS\u2019te belirtilen anahtar\/sertifika ile mi yap\u0131laca\u011f\u0131n\u0131 anlat\u0131r.<\/li>\n<li><strong>Selector<\/strong>: E\u015fle\u015ftirme sertifikan\u0131n tamam\u0131na m\u0131, yoksa SubjectPublicKeyInfo (SPKI) yani a\u00e7\u0131k anahtar b\u00f6l\u00fcm\u00fcne mi yap\u0131lacak?<\/li>\n<li><strong>Matching type<\/strong>: Tam de\u011fer mi kullan\u0131lacak, yoksa SHA-256 \/ SHA-512 \u00f6zet mi?<\/li>\n<\/ul>\n<p>Operasyonel bak\u0131\u015f a\u00e7\u0131s\u0131ndan en s\u0131k tercih edilen yakla\u015f\u0131m, sertifikan\u0131n tamam\u0131n\u0131 sabitlemek yerine SPKI \u00fczerinden sabitlemektir. \u00c7\u00fcnk\u00fc sertifika yenilerken (ayn\u0131 anahtar korunuyorsa) TLSA kayd\u0131n\u0131 de\u011fi\u015ftirme ihtiyac\u0131 azalabilir. Ancak anahtar yenileme\/rotasyon politikan\u0131z varsa, TLSA kayd\u0131 g\u00fcncelleme s\u00fcreci de buna g\u00f6re tasarlanmal\u0131d\u0131r.<\/p>\n<h2>SMTP\u2019de TLSA kayd\u0131 nerede yay\u0131nlan\u0131r?<\/h2>\n<p>TLSA kayd\u0131, belirli bir servis ve host i\u00e7in olu\u015fturulur. Format mant\u0131\u011f\u0131 \u015fu \u015fekildedir: <strong>_port._proto.host<\/strong>. SMTP i\u00e7in tipik \u00f6rnek <strong>_25._tcp<\/strong> \u00f6n ekidir ve host k\u0131sm\u0131 genellikle MX\u2019in i\u015faret etti\u011fi isimdir.<\/p>\n<p>\u00d6nemli pratik detay: DANE kurgusunda TLSA kayd\u0131n\u0131 \u201calan ad\u0131n\u0131n kendisine\u201d yazmak yerine, <strong>MX hedefi olan host ad\u0131na<\/strong> yazmak \u00e7o\u011fu senaryoda daha do\u011fru olur. \u00c7\u00fcnk\u00fc SMTP ba\u011flant\u0131s\u0131 fiilen MX hedefindeki sunucuya yap\u0131l\u0131r. \u00d6rne\u011fin example.com alan ad\u0131n\u0131n MX\u2019i mail.example.com ise TLSA kayd\u0131 mail.example.com i\u00e7in planlan\u0131r.<\/p>\n<p>Baz\u0131 yap\u0131larda birden fazla MX hedefi olabilir. Her bir MX hostu farkl\u0131 sunuculara gidiyorsa, her host i\u00e7in ayr\u0131 TLSA plan\u0131 gerekir. E\u011fer t\u00fcm MX\u2019ler ayn\u0131 TLS yap\u0131land\u0131rmas\u0131n\u0131 ve ayn\u0131 sertifikay\u0131 sunuyorsa, operasyon kolayla\u015f\u0131r; yine de kay\u0131tlar\u0131n tutarl\u0131 olmas\u0131na dikkat edilmelidir.<\/p>\n<h2>Ad\u0131m ad\u0131m g\u00fcvenli devreye alma plan\u0131<\/h2>\n<h3>1) Mevcut TLS sa\u011fl\u0131\u011f\u0131n\u0131 do\u011frulay\u0131n<\/h3>\n<p>DANE\u2019e ge\u00e7meden \u00f6nce STARTTLS davran\u0131\u015f\u0131n\u0131z\u0131n do\u011fru oldu\u011fundan emin olun: do\u011fru sertifika zinciri, do\u011fru host isimleri, g\u00fcncel protokoller ve tutarl\u0131 sunum. Buradaki hatalar DANE sonras\u0131 daha g\u00f6r\u00fcn\u00fcr hale gelir ve baz\u0131 g\u00f6ndericilerde teslimat sorunlar\u0131 yaratabilir.<\/p>\n<h3>2) DNSSEC\u2019i stabil hale getirin<\/h3>\n<p>DNSSEC etkinle\u015ftirmesi tek seferlik bir i\u015f de\u011fildir. Anahtar rotasyonu, sa\u011flay\u0131c\u0131 ta\u015f\u0131nmas\u0131, DS kayd\u0131 g\u00fcncellemeleri gibi s\u00fcre\u00e7ler i\u015fletme olgunlu\u011fu gerektirir. DANE plan\u0131na ge\u00e7meden \u00f6nce DNSSEC\u2019in d\u00fczenli \u015fekilde izlenebildi\u011finden emin olun.<\/p>\n<h3>3) TLSA de\u011ferini \u00fcretin ve d\u00fc\u015f\u00fck riskle yay\u0131nlay\u0131n<\/h3>\n<p>TLSA \u00fcretiminde en kritik k\u0131s\u0131m, do\u011fru sertifika\/anahtar\u0131n do\u011fru formatta \u00f6zetlenmesidir. Yanl\u0131\u015f \u00fcretilmi\u015f TLSA, DANE uygulayan g\u00f6ndericilerin size TLS kuramamas\u0131na yol a\u00e7abilir. Bu nedenle \u00fcretim ve do\u011frulama ad\u0131mlar\u0131n\u0131 bir kontrol listesiyle y\u00fcr\u00fct\u00fcn.<\/p>\n<h3>4) \u00c7oklu MX ve sertifika yenileme senaryolar\u0131n\u0131 test edin<\/h3>\n<p>Birden fazla MX\u2019iniz varsa, her birinin ayn\u0131 \u015fekilde TLS sundu\u011funu ve TLSA kay\u0131tlar\u0131n\u0131n uygun oldu\u011funu do\u011frulay\u0131n. Ayr\u0131ca sertifika yenileme g\u00fcn\u00fcnde ne olaca\u011f\u0131n\u0131 \u00f6nceden sim\u00fcle edin: yeni sertifika geldi\u011finde TLSA g\u00fcncellemesi gerekecek mi, TTL de\u011ferleri uygun mu, geri d\u00f6n\u00fc\u015f plan\u0131 var m\u0131?<\/p>\n<h3>5) \u0130zleme ve hata ay\u0131klama<\/h3>\n<p>DANE ge\u00e7i\u015finden sonra baz\u0131 uzak sistemler h\u00e2l\u00e2 opportunistic TLS kullanabilir, baz\u0131lar\u0131 ise DANE\u2019i aktif do\u011frulayabilir. Sorun ya\u015fand\u0131\u011f\u0131nda SMTP loglar\u0131nda tipik olarak TLS do\u011frulama hatalar\u0131, sertifika uyu\u015fmazl\u0131\u011f\u0131 veya DNSSEC do\u011frulama ba\u015far\u0131s\u0131zl\u0131\u011f\u0131na dair i\u015faretler g\u00f6r\u00fcl\u00fcr. Bu nedenle log toplama, mesaj izleme ve DNSSEC do\u011frulama kontrolleri birlikte ele al\u0131nmal\u0131d\u0131r.<\/p>\n<h2>Yayg\u0131n hatalar ve yanl\u0131\u015f beklentiler<\/h2>\n<ul>\n<li><strong>\u201cDANE kurdum, herkes TLS zorlayacak\u201d<\/strong>: DANE, kar\u015f\u0131 taraf\u0131n desteklemesine ba\u011fl\u0131d\u0131r. Destekleyenler i\u00e7in g\u00fc\u00e7l\u00fc do\u011frulama sa\u011flar; desteklemeyenler i\u00e7in davran\u0131\u015f de\u011fi\u015fmeyebilir.<\/li>\n<li><strong>Yanl\u0131\u015f hosta TLSA yazmak<\/strong>: Alan ad\u0131na TLSA yaz\u0131p MX hedefine yazmamak, pratikte etkisiz kalabilir.<\/li>\n<li><strong>DNSSEC k\u0131r\u0131lmas\u0131<\/strong>: S\u00fcresi dolmu\u015f imzalar, yanl\u0131\u015f DS, hatal\u0131 anahtar rotasyonu gibi durumlar yaln\u0131z DANE\u2019i de\u011fil, DNS \u00e7\u00f6z\u00fcmlemesini de etkileyebilir.<\/li>\n<li><strong>Sertifika yenileme g\u00fcn\u00fcn\u00fc unutmak<\/strong>: TLSA sertifikaya sabitlenmi\u015fse, sertifika de\u011fi\u015fince kay\u0131t g\u00fcncellenmezse DANE do\u011frulayan g\u00f6ndericiler teslimat\u0131 ge\u00e7ici olarak durdurabilir.<\/li>\n<\/ul>\n<h2>DANE, MTA-STS ve TLS: nas\u0131l konumland\u0131rmal\u0131?<\/h2>\n<p>DANE, DNSSEC g\u00fcven k\u00f6k\u00fcne dayan\u0131r. MTA-STS ise HTTPS \u00fczerinden yay\u0131mlanan bir politika ve DNS\u2019te bir i\u015faretleyici ile TLS\u2019i zorlamaya yard\u0131mc\u0131 olur. \u0130kisi ayn\u0131 problemi farkl\u0131 g\u00fcven modelleriyle ele al\u0131r. Baz\u0131 kurulu\u015flar birini, baz\u0131lar\u0131 ikisini birlikte tercih edebilir. Burada ama\u00e7 \u201ctek do\u011fru\u201d aramak de\u011fil; DNSSEC olgunlu\u011fu, operasyon kabiliyeti ve risk i\u015ftah\u0131 do\u011frultusunda uygun kombinasyonu se\u00e7mektir.<\/p>\n<h2>\u0130\u015fletmeler i\u00e7in pratik \u00f6neriler<\/h2>\n<ul>\n<li><strong>Envanter \u00e7\u0131kar\u0131n<\/strong>: Hangi alan adlar\u0131 e-posta al\u0131yor? MX hedefleri neler? Sertifika nerede y\u00f6netiliyor?<\/li>\n<li><strong>Standardize edin<\/strong>: MX host adlar\u0131n\u0131, sertifika isimlerini ve yenileme s\u00fcre\u00e7lerini m\u00fcmk\u00fcn oldu\u011funca tutarl\u0131 hale getirin.<\/li>\n<li><strong>TTL planlay\u0131n<\/strong>: TLSA de\u011fi\u015fikli\u011fi gerektirecek g\u00fcnlerde TTL\u2019leri \u00f6nceden d\u00fc\u015f\u00fcrmek geri d\u00f6n\u00fc\u015f\u00fc kolayla\u015ft\u0131r\u0131r.<\/li>\n<li><strong>Kademeli ilerleyin<\/strong>: \u00d6nce d\u00fc\u015f\u00fck trafikli bir alt alan ad\u0131 veya ikincil alan ad\u0131 \u00fczerinde s\u00fcre\u00e7leri test edip sonra ana alana ge\u00e7in.<\/li>\n<\/ul>\n<h2>Sonu\u00e7: DANE\u2019e ge\u00e7i\u015fi bir DNS ve operasyon projesi olarak ele al\u0131n<\/h2>\n<p>DANE for SMTP (TLSA), e-posta sunucular\u0131 aras\u0131nda TLS do\u011frulamas\u0131n\u0131 g\u00fc\u00e7lendirmek i\u00e7in etkili bir ara\u00e7t\u0131r; ancak temel ba\u011f\u0131ml\u0131l\u0131\u011f\u0131 DNSSEC oldu\u011fu i\u00e7in, do\u011fru planlama ve disiplinli i\u015fletim gerektirir. Ba\u015far\u0131l\u0131 bir kurulum, sertifika ya\u015fam d\u00f6ng\u00fcs\u00fc, MX mimarisi, DNSSEC y\u00f6netimi ve izleme pratiklerinin uyum i\u00e7inde \u00e7al\u0131\u015fmas\u0131na ba\u011fl\u0131d\u0131r.<\/p>\n<p>Kurumsal e-posta altyap\u0131n\u0131z\u0131 tasarlarken DNS, TLS ve teslimat izleme konular\u0131n\u0131 birlikte ele almak, uzun vadede daha az kesinti ve daha \u00f6ng\u00f6r\u00fclebilir bir i\u015fletim sa\u011flar. MX1Mail gibi profesyonel e-posta platformlar\u0131na ge\u00e7i\u015f veya mevcut yap\u0131n\u0131z\u0131 iyile\u015ftirme a\u015famalar\u0131nda, DANE\/DNSSEC dahil olmak \u00fczere DNS taraf\u0131ndaki de\u011fi\u015fiklikleri kontroll\u00fc ve geri d\u00f6n\u00fc\u015f planl\u0131 \u015fekilde y\u00f6netmek kritik \u00f6nem ta\u015f\u0131r.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>DANE for SMTP (TLSA) ile e-posta teslimat\u0131nda TLS sertifikas\u0131n\u0131 DNSSEC \u00fczerinden do\u011frulama mant\u0131\u011f\u0131n\u0131, \u00f6n ko\u015fullar\u0131, kay\u0131t t\u00fcrlerini ve g\u00fcvenli devreye alma ad\u0131mlar\u0131n\u0131 \u00f6\u011frenin.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[10],"tags":[485,487,489],"class_list":["post-183","post","type-post","status-publish","format-standard","hentry","category-e-posta-guvenligi","tag-dane","tag-dnssec","tag-tlsa"],"_links":{"self":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/posts\/183","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/comments?post=183"}],"version-history":[{"count":0,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/posts\/183\/revisions"}],"wp:attachment":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/media?parent=183"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/categories?post=183"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/tags?post=183"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}