{"id":72,"date":"2026-09-30T17:39:23","date_gmt":"2026-09-30T14:39:23","guid":{"rendered":"https:\/\/secradar.net\/blog\/eposta-guvenligi-testi-spf-dkim-dmarc-mta-sts\/"},"modified":"2026-09-30T17:39:23","modified_gmt":"2026-09-30T14:39:23","slug":"eposta-guvenligi-testi-spf-dkim-dmarc-mta-sts","status":"publish","type":"post","link":"https:\/\/secradar.net\/blog\/eposta-guvenligi-testi-spf-dkim-dmarc-mta-sts\/","title":{"rendered":"E-posta G\u00fcvenli\u011fi Testi: SPF, DKIM, DMARC ve MTA-STS&#8217;i Tek T\u0131kla \u00d6l\u00e7\u00fcn"},"content":{"rendered":"<p>E-posta, kurumsal ileti\u015fimin belkemi\u011fi; ama ayn\u0131 zamanda oltalama ve alan ad\u0131 taklidi (spoofing) sald\u0131r\u0131lar\u0131n\u0131n bir numaral\u0131 hedefi. Alan ad\u0131n\u0131z ad\u0131na sahte e-posta g\u00f6nderilmesini engellemek i\u00e7in \u00fc\u00e7 kay\u0131t bir arada \u00e7al\u0131\u015f\u0131r: <strong>SPF<\/strong>, <strong>DKIM<\/strong> ve <strong>DMARC<\/strong>. Bu yaz\u0131da bu kay\u0131tlar\u0131n ne i\u015fe yarad\u0131\u011f\u0131n\u0131, MTA-STS gibi daha yeni katmanlar\u0131 ve hepsini tek t\u0131kla nas\u0131l \u00f6l\u00e7ebilece\u011finizi anlat\u0131yoruz.<\/p>\n<p>Kay\u0131tlar\u0131n\u0131z\u0131n durumunu hemen g\u00f6rmek isterseniz <a href=\"\/eposta-guvenligi\">E-posta G\u00fcvenli\u011fi arac\u0131yla<\/a> alan ad\u0131n\u0131z\u0131 sorgulay\u0131n: SPF, DKIM, DMARC, MTA-STS, TLS-RPT ve BIMI kontrol edilir ve A\u2013F aras\u0131 bir not verilir.<\/p>\n<h2>SPF, DKIM ve DMARC K\u0131saca<\/h2>\n<h3>SPF (Sender Policy Framework)<\/h3>\n<p>Hangi sunucular\u0131n alan ad\u0131n\u0131z ad\u0131na e-posta g\u00f6nderebilece\u011fini bir DNS TXT kayd\u0131nda listeler. Al\u0131c\u0131 sunucu, g\u00f6nderen IP&#8217;yi bu listeyle kar\u015f\u0131la\u015ft\u0131r\u0131r. En kritik nokta kayd\u0131n <code>-all<\/code> (hard fail) ile bitmesidir; <code>~all<\/code> (soft fail) daha gev\u015fektir ve <code>?all<\/code> neredeyse hi\u00e7 koruma sa\u011flamaz.<\/p>\n<pre><code>v=spf1 include:_spf.google.com -all<\/code><\/pre>\n<p>SPF&#8217;in gizli bir tuza\u011f\u0131 vard\u0131r: kay\u0131t i\u00e7indeki <code>include<\/code> ve mekanizmalar toplamda <strong>10 DNS sorgusunu<\/strong> a\u015farsa kay\u0131t ge\u00e7ersiz say\u0131l\u0131r (permerror). Arac\u0131m\u0131z bu limiti de sayar.<\/p>\n<h3>DKIM (DomainKeys Identified Mail)<\/h3>\n<p>Giden her e-postaya, \u00f6zel anahtarla olu\u015fturulmu\u015f bir kriptografik imza ekler. Al\u0131c\u0131, imzay\u0131 <code>se\u00e7ici._domainkey.alanadi<\/code> alt\u0131ndaki genel anahtarla do\u011frular. B\u00f6ylece iletinin yolda de\u011fi\u015ftirilmedi\u011fi ve ger\u00e7ekten sizden geldi\u011fi kan\u0131tlan\u0131r. Se\u00e7ici (selector) adlar\u0131 sa\u011flay\u0131c\u0131ya g\u00f6re de\u011fi\u015fir (<code>google<\/code>, <code>selector1<\/code>, <code>k1<\/code>, <code>default<\/code>\u2026); test arac\u0131 en yayg\u0131n se\u00e7icileri otomatik dener.<\/p>\n<h3>DMARC (Domain-based Message Authentication)<\/h3>\n<p>SPF ve DKIM&#8217;i birbirine ba\u011flar ve <em>ba\u015far\u0131s\u0131z olan e-postaya ne yap\u0131laca\u011f\u0131n\u0131<\/em> siz belirlersiniz. Politika \u00fc\u00e7 kademelidir:<\/p>\n<ul>\n<li><code>p=none<\/code> \u2014 yaln\u0131zca izler\/raporlar, sahte e-postay\u0131 <strong>engellemez<\/strong>. Ba\u015flang\u0131\u00e7 i\u00e7in iyidir ama nihai hedef de\u011fildir.<\/li>\n<li><code>p=quarantine<\/code> \u2014 \u015f\u00fcpheli iletiyi spam&#8217;e d\u00fc\u015f\u00fcr\u00fcr.<\/li>\n<li><code>p=reject<\/code> \u2014 sahte iletiyi tamamen reddeder. En g\u00fc\u00e7l\u00fc koruma budur.<\/li>\n<\/ul>\n<pre><code>v=DMARC1; p=reject; rua=mailto:dmarc@alanadi.com; adkim=s; aspf=s<\/code><\/pre>\n<p><code>rua<\/code> adresi ekleyerek toplu raporlar\u0131 toplaman\u0131z, yay\u0131na ge\u00e7meden \u00f6nce me\u015fru g\u00f6nderenlerinizi g\u00f6rmeniz a\u00e7\u0131s\u0131ndan \u00e7ok \u00f6nemlidir.<\/p>\n<h2>Daha Yeni Katmanlar: MTA-STS, TLS-RPT ve BIMI<\/h2>\n<p>SPF\/DKIM\/DMARC g\u00f6nderen kimli\u011fini korur; ancak sunucular aras\u0131 ba\u011flant\u0131n\u0131n \u015fifreli kalmas\u0131n\u0131 garantilemez. \u0130\u015fte burada devreye girenler:<\/p>\n<ul>\n<li><strong>MTA-STS<\/strong>: G\u00f6nderen sunucular\u0131, size e-posta iletirken TLS kullanmaya zorlar ve <a href=\"\/blog\/ortadaki-adam-mitm-saldirisi-nedir\/\">STARTTLS d\u00fc\u015f\u00fcrme (stripping) sald\u0131r\u0131lar\u0131n\u0131<\/a> engeller.<\/li>\n<li><strong>TLS-RPT<\/strong>: TLS ile teslim edilemeyen iletiler hakk\u0131nda rapor al\u0131rs\u0131n\u0131z.<\/li>\n<li><strong>BIMI<\/strong>: DMARC <code>reject\/quarantine<\/code> zorunlulu\u011fuyla birlikte, gelen kutusunda logonuzun g\u00f6r\u00fcnmesini sa\u011flar; hem g\u00fcven hem marka de\u011feri.<\/li>\n<\/ul>\n<h2>Karnenizi Nas\u0131l Okumal\u0131s\u0131n\u0131z?<\/h2>\n<p>En s\u0131k kar\u015f\u0131la\u015f\u0131lan ve puan\u0131 d\u00fc\u015f\u00fcren bulgular \u015funlard\u0131r:<\/p>\n<ul>\n<li><strong>DMARC yok veya p=none<\/strong> \u2014 en kritik eksik. Alan ad\u0131n\u0131z ad\u0131na sahte e-posta serbest\u00e7e g\u00f6nderilebilir.<\/li>\n<li><strong>SPF <code>~all<\/code>\/<code>?all<\/code> ile bitiyor<\/strong> \u2014 koruma gev\u015fek; m\u00fcmk\u00fcnse <code>-all<\/code>&#8216;a ge\u00e7in.<\/li>\n<li><strong>DKIM imzas\u0131 bulunamad\u0131<\/strong> \u2014 sa\u011flay\u0131c\u0131n\u0131z\u0131n \u00f6nerdi\u011fi se\u00e7iciyi DNS&#8217;e ekleyin.<\/li>\n<li><strong>MTA-STS yok<\/strong> \u2014 sunucular aras\u0131 \u015fifreleme zorlanm\u0131yor.<\/li>\n<\/ul>\n<p>Do\u011fru s\u0131ralama genellikle \u015fudur: \u00f6nce SPF ve DKIM&#8217;i d\u00fczg\u00fcn kurun, DMARC&#8217;\u0131 <code>p=none<\/code> + <code>rua<\/code> ile ba\u015flat\u0131p raporlar\u0131 izleyin, me\u015fru g\u00f6nderenleri do\u011frulad\u0131ktan sonra kademeli olarak <code>quarantine<\/code> ve <code>reject<\/code>&#8216;e y\u00fckseltin.<\/p>\n<h2>S\u00fcrekli \u0130zleme<\/h2>\n<p>Bu kay\u0131tlar zamanla bozulabilir: bir \u00e7al\u0131\u015fan DMARC&#8217;\u0131 gev\u015fetir, SPF include limitini a\u015far ya da bir se\u00e7ici kald\u0131r\u0131l\u0131r. SecRadar \u00fcye panelinde alan ad\u0131n\u0131z\u0131 ekleyerek e-posta g\u00fcvenli\u011fini <strong>s\u00fcrekli izleyebilir<\/strong>, DMARC politikas\u0131 zay\u0131flad\u0131\u011f\u0131nda veya SPF\/DKIM bozuldu\u011funda e-posta ya da Telegram ile an\u0131nda uyar\u0131 alabilirsiniz.<\/p>\n<p>Ayr\u0131nt\u0131l\u0131 temel bilgi i\u00e7in <a href=\"\/blog\/spf-dkim-dmarc-eposta-guvenligi\/\">SPF, DKIM ve DMARC ile E-posta G\u00fcvenli\u011fi<\/a> yaz\u0131m\u0131za, oltalamaya kar\u015f\u0131 korunma i\u00e7in <a href=\"\/blog\/oltalama-phishing-nedir-korunma\/\">Oltalama (Phishing) rehberimize<\/a> g\u00f6z at\u0131n. Hemen \u00f6l\u00e7mek i\u00e7in <a href=\"\/eposta-guvenligi\">E-posta G\u00fcvenli\u011fi testini<\/a> \u00e7al\u0131\u015ft\u0131r\u0131n.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>SPF, DKIM, DMARC ve MTA-STS kay\u0131tlar\u0131n\u0131z\u0131 tek t\u0131kla test edin; A-F g\u00fcvenlik notunuzu g\u00f6r\u00fcn, en s\u0131k eksikleri ve d\u00fczeltmelerini \u00f6\u011frenin.<\/p>\n","protected":false},"author":1,"featured_media":75,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[6],"tags":[],"class_list":["post-72","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-guvenlik"],"_links":{"self":[{"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/posts\/72","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/comments?post=72"}],"version-history":[{"count":0,"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/posts\/72\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/media\/75"}],"wp:attachment":[{"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/media?parent=72"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/categories?post=72"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/tags?post=72"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}