{"id":73,"date":"2026-09-30T17:39:24","date_gmt":"2026-09-30T14:39:24","guid":{"rendered":"https:\/\/secradar.net\/blog\/mail-sunucusu-tls-guvenligi-smtp-imap-pop\/"},"modified":"2026-09-30T17:39:24","modified_gmt":"2026-09-30T14:39:24","slug":"mail-sunucusu-tls-guvenligi-smtp-imap-pop","status":"publish","type":"post","link":"https:\/\/secradar.net\/blog\/mail-sunucusu-tls-guvenligi-smtp-imap-pop\/","title":{"rendered":"Mail Sunucusu TLS G\u00fcvenli\u011fi: SMTP, IMAP ve POP Portlar\u0131nda \u015eifreleme"},"content":{"rendered":"<p>SSL\/TLS denince akla ilk web siteleri (443 portu) gelir. Oysa e-postan\u0131n ta\u015f\u0131nd\u0131\u011f\u0131 SMTP, IMAP ve POP portlar\u0131 da en az onun kadar kritiktir. Bir mail sunucusunun sertifikas\u0131 sessizce s\u00fcresi doldu\u011funda ya da yaln\u0131zca eski TLS s\u00fcr\u00fcmlerini destekledi\u011finde, e-posta ak\u0131\u015f\u0131 kesilir veya araya giren biri iletileri okuyabilir. Bu yaz\u0131da mail servislerinde TLS&#8217;in nas\u0131l \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 ve <a href=\"\/mail-tls-kontrolu\">Mail \/ Servis TLS arac\u0131yla<\/a> bunu nas\u0131l denetleyece\u011finizi anlat\u0131yoruz.<\/p>\n<h2>Mail Portlar\u0131 ve \u015eifreleme Modelleri<\/h2>\n<p>E-posta iki farkl\u0131 TLS modeli kullan\u0131r:<\/p>\n<ul>\n<li><strong>Implicit TLS (ba\u015ftan \u015fifreli):<\/strong> Ba\u011flant\u0131 daha ilk saniyeden TLS ile a\u00e7\u0131l\u0131r. Portlar: <code>465<\/code> (SMTPS), <code>993<\/code> (IMAPS), <code>995<\/code> (POP3S).<\/li>\n<li><strong>STARTTLS (f\u0131rsat\u00e7\u0131 \u015fifreleme):<\/strong> Ba\u011flant\u0131 d\u00fcz metin ba\u015flar, sonra <code>STARTTLS<\/code> komutuyla \u015fifreliye y\u00fckseltilir. Portlar: <code>587<\/code> (Submission), <code>25<\/code> (SMTP), <code>143<\/code> (IMAP), <code>110<\/code> (POP3).<\/li>\n<\/ul>\n<p>STARTTLS&#8217;in zay\u0131f noktas\u0131 \u015fudur: y\u00fckseltme ba\u015flamadan \u00f6nce araya giren bir sald\u0131rgan <code>STARTTLS<\/code> komutunu d\u00fc\u015f\u00fcrebilir (STARTTLS stripping) ve ileti\u015fim d\u00fcz metin kal\u0131r. Bu y\u00fczden m\u00fcmk\u00fcn olan yerde implicit TLS (465\/993\/995) tercih edilir ve g\u00f6nderen tarafta <a href=\"\/blog\/ortadaki-adam-mitm-saldirisi-nedir\/\">MITM sald\u0131r\u0131lar\u0131na<\/a> kar\u015f\u0131 MTA-STS gibi zorlay\u0131c\u0131lar kullan\u0131l\u0131r.<\/p>\n<h2>Mail Sunucusunda Neler Yanl\u0131\u015f Gider?<\/h2>\n<h3>Sessizce Dolan Sertifika<\/h3>\n<p>Web sertifikan\u0131z\u0131 d\u00fczenli yenilerken mail sunucusunun sertifikas\u0131n\u0131 unutmak \u00e7ok yayg\u0131nd\u0131r. S\u00fcre doldu\u011funda istemciler &#8220;g\u00fcvenli de\u011fil&#8221; uyar\u0131s\u0131 verir veya ba\u011flant\u0131y\u0131 tamamen reddeder \u2014 \u00e7o\u011fu zaman kimse fark etmeden e-posta trafi\u011fi durur.<\/p>\n<h3>Eksik Sertifika Zinciri<\/h3>\n<p>Sunucuya yaln\u0131zca yaprak (leaf) sertifika y\u00fcklenip ara sertifika (intermediate) atland\u0131\u011f\u0131nda, baz\u0131 istemciler zinciri do\u011frulayamaz. Taray\u0131c\u0131lar bazen eksik ara sertifikay\u0131 tamamlar ama mail istemcileri genellikle tamamlamaz; sonu\u00e7: sizde \u00e7al\u0131\u015f\u0131r, kar\u015f\u0131 tarafta \u00e7al\u0131\u015fmaz.<\/p>\n<h3>Zay\u0131f TLS S\u00fcr\u00fcmleri<\/h3>\n<p>TLS 1.0 ve 1.1 art\u0131k g\u00fcvensiz kabul edilir. Mail sunucular\u0131 web sunucular\u0131na g\u00f6re daha ge\u00e7 g\u00fcncellendi\u011finden, h\u00e2l\u00e2 bu eski s\u00fcr\u00fcmleri a\u00e7\u0131k b\u0131rakanlar \u00e7oktur. Neden kapat\u0131lmalar\u0131 gerekti\u011fini <a href=\"\/blog\/tls-1-2-1-3-farki\/\">TLS 1.2 ve 1.3 Fark\u0131<\/a> yaz\u0131m\u0131zda ayr\u0131nt\u0131l\u0131 bulabilirsiniz.<\/p>\n<h2>Arac\u0131m\u0131z Ne Kontrol Eder?<\/h2>\n<p>Mail \/ Servis TLS arac\u0131, verdi\u011finiz host i\u00e7in yayg\u0131n mail portlar\u0131na tek tek ba\u011flan\u0131r ve her port i\u00e7in \u015funlar\u0131 raporlar:<\/p>\n<ul>\n<li>Sertifikan\u0131n <strong>biti\u015f tarihi<\/strong> ve kalan g\u00fcn say\u0131s\u0131,<\/li>\n<li>Sertifika <strong>zincirinin<\/strong> tam olup olmad\u0131\u011f\u0131 (eksik ara sertifika tespiti),<\/li>\n<li>Desteklenen TLS s\u00fcr\u00fcmleri ve <strong>zay\u0131f s\u00fcr\u00fcm<\/strong> (1.0\/1.1) uyar\u0131s\u0131,<\/li>\n<li>STARTTLS gereken portlarda y\u00fckseltmenin ger\u00e7ekten \u00e7al\u0131\u015f\u0131p \u00e7al\u0131\u015fmad\u0131\u011f\u0131.<\/li>\n<\/ul>\n<h2>\u00d6nemli: MX Kayd\u0131 Her Zaman Mail Sunucusu De\u011fildir<\/h2>\n<p>Bir alan ad\u0131n\u0131n MX kayd\u0131 \u00e7o\u011fu zaman do\u011frudan mail sunucusuna de\u011fil, \u00f6n\u00fcndeki bir <strong>g\u00fcvenlik a\u011f ge\u00e7idine<\/strong> (spam filtresi\/relay) i\u015faret eder. Bu y\u00fczden test ederken apex alan ad\u0131n\u0131 de\u011fil, as\u0131l izlemek istedi\u011finiz <strong>mail sunucusunun host ad\u0131n\u0131<\/strong> (\u00f6r. <code>mail.firma.com<\/code>) girmelisiniz. Web sitesi (Cloudflare vb.) ile mail sunucusu genellikle farkl\u0131 hedeflerdir; ikisini ayr\u0131 ayr\u0131 kontrol edin.<\/p>\n<h2>S\u00fcrekli \u0130zleme<\/h2>\n<p>Sertifika biti\u015fleri her zaman en k\u00f6t\u00fc zamanda gelir. SecRadar \u00fcye panelinde mail sunucunuzun host ad\u0131n\u0131 ayr\u0131 bir hedef olarak ekleyip <strong>Mail TLS<\/strong> kontrol\u00fcn\u00fc a\u00e7t\u0131\u011f\u0131n\u0131zda; sertifika biti\u015fine 30\/15\/7 g\u00fcn kala, zincir bozuldu\u011funda veya zay\u0131f bir TLS s\u00fcr\u00fcm\u00fc a\u00e7\u0131ld\u0131\u011f\u0131nda e-posta ya da Telegram bildirimi al\u0131rs\u0131n\u0131z.<\/p>\n<p>Genel SSL\/TLS temeli i\u00e7in <a href=\"\/blog\/ssl-sertifikasi-nedir-nasil-alinir\/\">SSL Sertifikas\u0131 Nedir, Nas\u0131l Al\u0131n\u0131r?<\/a> yaz\u0131m\u0131za bak\u0131n; mail sunucunuzu hemen test etmek i\u00e7in <a href=\"\/mail-tls-kontrolu\">Mail \/ Servis TLS arac\u0131n\u0131<\/a> kullan\u0131n.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>SMTP\/IMAP\/POP portlar\u0131nda sertifika biti\u015fi, eksik zincir ve zay\u0131f TLS s\u00fcr\u00fcm\u00fc nas\u0131l tespit edilir? Mail sunucusu TLS g\u00fcvenli\u011fi rehberi.<\/p>\n","protected":false},"author":1,"featured_media":76,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-73","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ssl-sertifika"],"_links":{"self":[{"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/posts\/73","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/comments?post=73"}],"version-history":[{"count":0,"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/posts\/73\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/media\/76"}],"wp:attachment":[{"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/media?parent=73"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/categories?post=73"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/secradar.net\/blog\/wp-json\/wp\/v2\/tags?post=73"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}