{"id":189,"date":"2026-10-24T09:01:24","date_gmt":"2026-10-24T06:01:24","guid":{"rendered":"https:\/\/mx1mail.com\/blog\/smtp-timeout-baglanti-hatalari-firewall-nat-mtu-tls-teshis\/"},"modified":"2026-10-24T09:01:24","modified_gmt":"2026-10-24T06:01:24","slug":"smtp-timeout-baglanti-hatalari-firewall-nat-mtu-tls-teshis","status":"publish","type":"post","link":"https:\/\/mx1mail.com\/blog\/tr\/smtp-timeout-baglanti-hatalari-firewall-nat-mtu-tls-teshis\/","title":{"rendered":"SMTP Timeout ve Ba\u011flant\u0131 Hatalar\u0131 (4xx\/5xx) Nas\u0131l \u00c7\u00f6z\u00fcl\u00fcr? Firewall, NAT, MTU ve TLS Sorunlar\u0131n\u0131 Te\u015fhis Rehberi"},"content":{"rendered":"<h2>SMTP timeout neden \u201cbelirsiz\u201d g\u00f6r\u00fcn\u00fcr?<\/h2>\n<p>SMTP iletimindeki en zor vakalar genellikle \u201ctimeout\u201d veya \u201cconnection reset\u201d gibi net olmayan belirtilerle ba\u015flar. \u00c7\u00fcnk\u00fc SMTP, tek bir uygulama katman\u0131 protokol\u00fc gibi g\u00f6r\u00fcnse de; DNS \u00e7\u00f6z\u00fcmleme, TCP ba\u011flant\u0131s\u0131, a\u011f y\u00f6nlendirme, g\u00fcvenlik cihazlar\u0131, TLS pazarl\u0131\u011f\u0131 ve kar\u015f\u0131 sunucunun politikalar\u0131 birlikte \u00e7al\u0131\u015f\u0131r. Bu zincirin herhangi bir halkas\u0131nda ya\u015fanan k\u00fc\u00e7\u00fck bir aksama, istemcinin yaln\u0131zca \u201cba\u011flanamad\u0131m\u201d demesine neden olabilir.<\/p>\n<p>Bu rehber, SMTP g\u00f6nderiminde ve sunucular aras\u0131 teslimatta g\u00f6r\u00fclen ba\u011flant\u0131 odakl\u0131 hatalar\u0131 sistematik \u015fekilde te\u015fhis etmek i\u00e7in tasarlanm\u0131\u015ft\u0131r. Ama\u00e7, rastgele deneme-yan\u0131lma yerine katman katman ilerleyerek k\u00f6k nedeni bulmakt\u0131r.<\/p>\n<h2>En s\u0131k g\u00f6r\u00fclen belirtiler ve tipik hata mesajlar\u0131<\/h2>\n<p>Farkl\u0131 MTA\u2019lar ve istemciler ayn\u0131 sorunu farkl\u0131 metinlerle raporlayabilir. Yine de a\u015fa\u011f\u0131daki ba\u015fl\u0131klar, olay\u0131n ba\u011flant\u0131\/TLS\/a\u011f taraf\u0131nda oldu\u011funu g\u00fc\u00e7l\u00fc \u015fekilde i\u015faret eder:<\/p>\n<ul>\n<li><strong>Connection timed out<\/strong>: TCP \u00fc\u00e7l\u00fc el s\u0131k\u0131\u015fma tamamlanam\u0131yor veya yol \u00fczerinde paketler d\u00fc\u015f\u00fcyor.<\/li>\n<li><strong>Connection refused<\/strong>: Hedef IP\u2019ye gidiliyor ama ilgili portta servis dinlemiyor veya firewall aktif olarak reddediyor.<\/li>\n<li><strong>Network is unreachable \/ No route to host<\/strong>: Y\u00f6nlendirme problemi, yanl\u0131\u015f IP, hatal\u0131 policy routing veya upstream blok.<\/li>\n<li><strong>Connection reset by peer<\/strong>: Kar\u015f\u0131 u\u00e7 (veya aradaki cihaz) ba\u011flant\u0131y\u0131 aniden kapat\u0131yor. S\u0131k neden: TLS\/STARTTLS sorunlar\u0131 veya g\u00fcvenlik cihaz\u0131 m\u00fcdahalesi.<\/li>\n<li><strong>421\/451 temporary failure<\/strong>: Kar\u015f\u0131 taraf ge\u00e7ici ret veriyor; bazen rate limit, bazen de g\u00fcvenlik kontrolleri (\u00f6rn. TLS zorlamas\u0131) nedeniyle.<\/li>\n<li><strong>SSL\/TLS handshake failure<\/strong>: Sertifika zinciri, SNI, protokol s\u00fcr\u00fcm\u00fc, \u015fifre tak\u0131m\u0131 veya STARTTLS ak\u0131\u015f\u0131nda uyumsuzluk.<\/li>\n<\/ul>\n<h2>\u00d6nce y\u00f6n\u00fc belirleyin: G\u00f6nderim mi, al\u0131m m\u0131, istemci eri\u015fimi mi?<\/h2>\n<p>Ayn\u0131 \u201cSMTP\u201d kelimesi \u00fc\u00e7 farkl\u0131 trafik tipini kapsar ve te\u015fhis yakla\u015f\u0131m\u0131 de\u011fi\u015fir:<\/p>\n<ul>\n<li><strong>SMTP Submission (kullan\u0131c\u0131 g\u00f6nderimi)<\/strong>: Genellikle 587 veya 465. Kullan\u0131c\u0131 istemcileri buraya ba\u011flan\u0131r.<\/li>\n<li><strong>SMTP Relay \/ Sunucudan sunucuya teslim<\/strong>: Genellikle 25. D\u0131\u015f d\u00fcnyaya teslim veya d\u0131\u015f d\u00fcnyadan al\u0131m bu hat \u00fczerinden y\u00fcr\u00fcr.<\/li>\n<li><strong>\u0130\u00e7 a\u011fdan MTA\u2019ya ba\u011flant\u0131<\/strong>: Firewall segmentleri, VPN, SD-WAN gibi unsurlar daha bask\u0131n olabilir.<\/li>\n<\/ul>\n<p>Hata hangi y\u00f6nde? \u201cBiz d\u0131\u015far\u0131 g\u00f6nderemiyoruz\u201d ile \u201cd\u0131\u015far\u0131dan mail alam\u0131yoruz\u201d ayn\u0131 de\u011fildir. Loglarda hedef IP\/port ve ba\u011flant\u0131 denemesinin nereden yap\u0131ld\u0131\u011f\u0131 netle\u015fmeden \u00e7\u00f6z\u00fcm \u00fcretmeyin.<\/p>\n<h2>Ad\u0131m ad\u0131m te\u015fhis: DNS, TCP, TLS, uygulama<\/h2>\n<h3>1) DNS \u00e7\u00f6z\u00fcmleme ve hedef se\u00e7imi<\/h3>\n<p>Sunucudan sunucuya teslimde ilk ad\u0131m DNS\u2019dir: MX kay\u0131tlar\u0131, ilgili A\/AAAA kay\u0131tlar\u0131 ve bazen de yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f IPv6, yanl\u0131\u015f hedefe gitmenize yol a\u00e7abilir. Tipik senaryolar:<\/p>\n<ul>\n<li>MX, art\u0131k kullan\u0131lmayan eski bir hosta i\u015faret ediyordur.<\/li>\n<li>MX hostunun <strong>AAAA<\/strong> kayd\u0131 vard\u0131r ama IPv6 \u00e7\u0131k\u0131\u015f\u0131 yoktur; MTA IPv6\u2019\u0131 dener ve timeout ya\u015far.<\/li>\n<li>Split-horizon DNS y\u00fcz\u00fcnden i\u00e7 a\u011f farkl\u0131, d\u0131\u015f a\u011f farkl\u0131 cevap d\u00f6n\u00fcyordur.<\/li>\n<\/ul>\n<p>\u00c7\u00f6z\u00fcm: Sorun ya\u015fayan sistemin kendisinden DNS sorgusu yaparak hangi IP\u2019nin se\u00e7ildi\u011fini do\u011frulay\u0131n. Gerekirse IPv6 denemelerini ge\u00e7ici olarak s\u0131n\u0131rlamak veya do\u011fru IPv6 \u00e7\u0131k\u0131\u015f\u0131n\u0131 sa\u011flamak gerekebilir.<\/p>\n<h3>2) TCP ba\u011flant\u0131 testi: Port a\u00e7\u0131k m\u0131, yol temiz mi?<\/h3>\n<p>DNS do\u011fruysa bir sonraki ad\u0131m saf TCP testidir. \u201cConnection refused\u201d genellikle hedefte servis yok veya port firewall taraf\u0131ndan aktif reddediliyor demektir. \u201cTimeout\u201d ise daha \u00e7ok yol \u00fczerinde filtreleme, asimetrik routing, NAT sorunlar\u0131 veya upstream bloklara i\u015faret eder.<\/p>\n<p>Bu noktada \u015fu sorular\u0131 cevaplay\u0131n:<\/p>\n<ul>\n<li>Testi <strong>ayn\u0131 sunucudan<\/strong> mi yap\u0131yorsunuz? Masa\u00fcst\u00fc bilgisayardan test etmek yan\u0131lt\u0131c\u0131 olabilir.<\/li>\n<li>Hedef port: 25 mi, 587 mi, 465 mi? Yanl\u0131\u015f port se\u00e7imi s\u0131k g\u00f6r\u00fcl\u00fcr.<\/li>\n<li>\u00c7\u0131k\u0131\u015f firewall\u2019\u0131n\u0131z <strong>outbound 25<\/strong> trafi\u011fini k\u0131s\u0131tl\u0131yor mu? Baz\u0131 a\u011flarda 25 d\u0131\u015far\u0131 kapal\u0131 olabilir.<\/li>\n<\/ul>\n<h3>3) Firewall, NAT ve state table problemleri<\/h3>\n<p>SMTP ba\u011flant\u0131lar\u0131 uzun s\u00fcre a\u00e7\u0131k kalabildi\u011fi i\u00e7in firewall state y\u00f6netimi \u00f6nemlidir. \u00d6zellikle y\u00fcksek hacim veya yo\u011fun tekrar denemelerde state table dolabilir, ba\u011flant\u0131lar yar\u0131da kesilebilir. Ayr\u0131ca NAT arkas\u0131ndaki sistemlerde \u201chairpin NAT\u201d, yanl\u0131\u015f port y\u00f6nlendirme veya k\u0131sa NAT timeout de\u011ferleri ba\u011flant\u0131 kopmalar\u0131na neden olabilir.<\/p>\n<p>Dikkat edilmesi gerekenler:<\/p>\n<ul>\n<li><strong>Outbound<\/strong> ve <strong>inbound<\/strong> kurallar\u0131n\u0131n ayr\u0131 ayr\u0131 do\u011frulanmas\u0131 (\u00f6zellikle 25\/587\/465).<\/li>\n<li>IPS\/IDS cihazlar\u0131n\u0131n STARTTLS trafi\u011fini yanl\u0131\u015f s\u0131n\u0131fland\u0131r\u0131p ba\u011flant\u0131y\u0131 kapatmas\u0131.<\/li>\n<li>NAT timeout de\u011ferlerinin SMTP oturumlar\u0131 i\u00e7in \u00e7ok k\u0131sa olmas\u0131.<\/li>\n<\/ul>\n<p>Belirti: Ba\u011flant\u0131 kurulur, banner gelir; STARTTLS veya AUTH sonras\u0131nda aniden reset olur. Bu durumda aradaki g\u00fcvenlik cihazlar\u0131n\u0131 devre d\u0131\u015f\u0131 b\u0131rakmadan \u00f6nce loglar\u0131n\u0131 kontrol etmek kritiktir.<\/p>\n<h3>4) MTU ve PMTUD: \u201cG\u00f6r\u00fcnmez\u201d paket kayb\u0131<\/h3>\n<p>Baz\u0131 a\u011f sorunlar\u0131 sadece belirli paket boyutlar\u0131nda ortaya \u00e7\u0131kar. \u00d6zellikle VPN, PPPoE, t\u00fcnelleme veya yanl\u0131\u015f ICMP bloklar\u0131 varsa Path MTU Discovery d\u00fczg\u00fcn \u00e7al\u0131\u015fmayabilir. Sonu\u00e7: k\u00fc\u00e7\u00fck paketler gider, b\u00fcy\u00fck paketler kaybolur; TLS handshake gibi daha b\u00fcy\u00fck paketli ak\u0131\u015flar tak\u0131labilir.<\/p>\n<p>Pratikte bu durum \u015fu \u015fekilde g\u00f6r\u00fcn\u00fcr:<\/p>\n<ul>\n<li>TCP ba\u011flant\u0131s\u0131 kurulur ama TLS pazarl\u0131\u011f\u0131 s\u0131ras\u0131nda timeout olur.<\/li>\n<li>Baz\u0131 al\u0131c\u0131lara s\u00fcrekli sorun varken baz\u0131lar\u0131na hi\u00e7 sorun olmaz (yol farkl\u0131l\u0131\u011f\u0131).<\/li>\n<\/ul>\n<p>\u00c7\u00f6z\u00fcm yakla\u015f\u0131m\u0131: MTU de\u011ferlerini ve t\u00fcnel\/wan hatlar\u0131n\u0131 inceleyin; ICMP\u2019nin tamamen kapat\u0131lmas\u0131n\u0131n yan etkilerini de\u011ferlendirin. Gerekirse ilgili aray\u00fczlerde MTU\/MSS ayar\u0131yla sorunu stabilize edin.<\/p>\n<h3>5) TLS\/STARTTLS pazarl\u0131\u011f\u0131 ve sertifika kaynakl\u0131 kopmalar<\/h3>\n<p>SMTP\u2019de TLS \u00e7o\u011funlukla STARTTLS ile \u201cayn\u0131 port \u00fczerinde y\u00fckseltme\u201d \u015feklinde \u00e7al\u0131\u015f\u0131r. Bu a\u015famada ya\u015fanan sorunlar ba\u011flant\u0131n\u0131n resetlenmesi veya handshake failure olarak yans\u0131r.<\/p>\n<p>S\u0131k nedenler:<\/p>\n<ul>\n<li>Yanl\u0131\u015f sertifika zinciri (ara sertifika eksik).<\/li>\n<li>Sertifika <strong>hostname<\/strong> ile uyu\u015fmuyor (\u00f6zellikle load balancer veya farkl\u0131 isimler).<\/li>\n<li>Eski TLS s\u00fcr\u00fcmleri veya \u015fifre tak\u0131mlar\u0131 y\u00fcz\u00fcnden uyumsuzluk.<\/li>\n<li>SNI bekleniyor ama istemci g\u00f6ndermiyor ya da tersine.<\/li>\n<\/ul>\n<p>Kar\u015f\u0131 taraf MTA-STS veya kurumsal TLS politikalar\u0131 uyguluyorsa, TLS sorunlar\u0131 \u201cge\u00e7ici\u201d gibi g\u00f6r\u00fcnen 4xx\u2019lerle de ortaya \u00e7\u0131kabilir. Bu nedenle sadece hata koduna de\u011fil, ayn\u0131 zamanda hangi a\u015famada koptu\u011funa bak\u0131n.<\/p>\n<h2>Uygulama katman\u0131 kontrolleri: Yetkilendirme, oran limitleri, i\u00e7erik de\u011fil ba\u011flant\u0131<\/h2>\n<p>Baz\u0131 hatalar ba\u011flant\u0131 sorunu gibi g\u00f6r\u00fcnse de uygulama politikas\u0131d\u0131r. \u00d6rne\u011fin submission taraf\u0131nda yanl\u0131\u015f kullan\u0131c\u0131 ad\u0131\/parola, zorunlu AUTH politikas\u0131 veya IP k\u0131s\u0131t\u0131 \u201cba\u011fland\u0131 ama g\u00f6nderemedi\u201d \u015feklinde ya\u015fan\u0131r. Sunucudan sunucuya teslimde ise baz\u0131 sistemler \u015f\u00fcpheli davran\u0131\u015fta (\u00e7ok h\u0131zl\u0131 deneme, hatal\u0131 HELO, anormal hacim) 4xx ile yava\u015flatma uygulayabilir.<\/p>\n<p>Bu a\u015famada yap\u0131lacaklar:<\/p>\n<ul>\n<li>Loglarda \u201cconnect\u201d sonras\u0131ndaki komut ak\u0131\u015f\u0131n\u0131 inceleyin: EHLO, STARTTLS, AUTH, MAIL FROM, RCPT TO.<\/li>\n<li>Hatan\u0131n <strong>hangi komutta<\/strong> geldi\u011fini not edin. RCPT TO\u2019daki 450 ile connect timeout ayn\u0131 \u015fey de\u011fildir.<\/li>\n<li>Deneme say\u0131s\u0131, e\u015fzamanl\u0131 ba\u011flant\u0131 say\u0131s\u0131 ve yeniden deneme aral\u0131klar\u0131n\u0131 g\u00f6zden ge\u00e7irin.<\/li>\n<\/ul>\n<h2>H\u0131zl\u0131 k\u00f6k neden e\u015fle\u015ftirme tablosu (pratik)<\/h2>\n<ul>\n<li><strong>Timeout (her hedefte)<\/strong>: \u00c7\u0131k\u0131\u015f firewall, ISP bloklar\u0131, routing, DNS yanl\u0131\u015fl\u0131\u011f\u0131.<\/li>\n<li><strong>Timeout (baz\u0131 hedeflerde)<\/strong>: Uzak taraf\u0131n IP bazl\u0131 bloklar\u0131, yol\/peering sorunlar\u0131, MTU.<\/li>\n<li><strong>Refused<\/strong>: Hedef port kapal\u0131, yanl\u0131\u015f port, yanl\u0131\u015f IP.<\/li>\n<li><strong>Reset (STARTTLS sonras\u0131)<\/strong>: TLS uyumsuzlu\u011fu, sertifika zinciri, g\u00fcvenlik cihaz\u0131 m\u00fcdahalesi.<\/li>\n<li><strong>421\/451<\/strong>: Uzak taraf ge\u00e7ici politika, rate limit veya g\u00fcvenlik kontrolleri; yeniden deneme mant\u0131\u011f\u0131n\u0131 do\u011frulay\u0131n.<\/li>\n<\/ul>\n<h2>Kal\u0131c\u0131 \u00f6nleme: \u0130zleme, de\u011fi\u015fiklik y\u00f6netimi ve test rutini<\/h2>\n<p>SMTP ba\u011flant\u0131 sorunlar\u0131 \u00e7o\u011fu zaman bir de\u011fi\u015fiklik sonras\u0131 patlar: firewall kural g\u00fcncellemesi, sertifika yenilemesi, WAN sa\u011flay\u0131c\u0131 de\u011fi\u015fimi, yeni bir IPS profili, DNS g\u00fcncellemesi gibi. Bu y\u00fczden teknik \u00f6nlemler kadar operasyonel disiplin de \u00f6nemlidir.<\/p>\n<ul>\n<li><strong>De\u011fi\u015fiklik \u00f6ncesi<\/strong> temel testler: DNS \u00e7\u00f6z\u00fcmleme, port eri\u015fimi, STARTTLS do\u011frulamas\u0131.<\/li>\n<li><strong>De\u011fi\u015fiklik sonras\u0131<\/strong> do\u011frulama: Ayn\u0131 testlerin tekrar\u0131 ve loglarda anomali kontrol\u00fc.<\/li>\n<li><strong>Alarm ve metrikler<\/strong>: Queue b\u00fcy\u00fcmesi, ba\u011flant\u0131 hata oranlar\u0131, TLS handshake hata say\u0131lar\u0131.<\/li>\n<li><strong>Yedek yol plan\u0131<\/strong>: Alternatif \u00e7\u0131k\u0131\u015f IP\u2019si veya failover MX tasar\u0131m\u0131 (ihtiyaca g\u00f6re).<\/li>\n<\/ul>\n<h2>Sonu\u00e7: Sistematik yakla\u015f\u0131m, daha h\u0131zl\u0131 \u00e7\u00f6z\u00fcm<\/h2>\n<p>SMTP timeout ve ba\u011flant\u0131 hatalar\u0131n\u0131 \u00e7\u00f6zmenin anahtar\u0131 \u201ctek bir ayar\u201d aramak de\u011fil, zincirin hangi halkas\u0131n\u0131n koptu\u011funu bulmakt\u0131r: DNS do\u011fru mu, TCP yolunda engel var m\u0131, firewall\/NAT oturumu do\u011fru y\u00f6netiyor mu, MTU\/TLS gibi hassas alanlarda paket kayb\u0131 var m\u0131, uygulama politikalar\u0131 ba\u011flant\u0131dan sonra m\u0131 devreye giriyor?<\/p>\n<p>MX1Mail gibi kurumsal e-posta altyap\u0131lar\u0131nda bu t\u00fcr te\u015fhisler yap\u0131l\u0131rken, loglar\u0131n do\u011fru yorumlanmas\u0131 ve kontroll\u00fc testlerin ayn\u0131 kaynaktan (sorunu ya\u015fayan sunucudan\/istemciden) yap\u0131lmas\u0131 s\u00fcreyi ciddi bi\u00e7imde k\u0131salt\u0131r. K\u00f6k nedeni netle\u015ftirdi\u011finizde \u00e7\u00f6z\u00fcm genellikle basittir: do\u011fru port ve kural, do\u011fru DNS hedefi, do\u011fru TLS zinciri veya do\u011fru a\u011f parametresi.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>SMTP timeout, ba\u011flant\u0131 kopmas\u0131 ve 4xx\/5xx hatalar\u0131nda k\u00f6k nedeni bulmak i\u00e7in firewall, NAT, MTU, DNS ve TLS katmanlar\u0131n\u0131 ad\u0131m ad\u0131m kontrol eden pratik te\u015fhis rehberi.<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[504],"tags":[510,506,508],"class_list":["post-189","post","type-post","status-publish","format-standard","hentry","category-e-posta-sorun-giderme","tag-firewall-ve-ag","tag-smtp-hata-ayiklama","tag-tls-ve-starttls"],"_links":{"self":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/posts\/189","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/comments?post=189"}],"version-history":[{"count":0,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/posts\/189\/revisions"}],"wp:attachment":[{"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/media?parent=189"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/categories?post=189"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/mx1mail.com\/blog\/wp-json\/wp\/v2\/tags?post=189"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}