{"id":16610,"date":"2026-09-28T16:06:00","date_gmt":"2026-09-28T13:06:00","guid":{"rendered":"https:\/\/www.ihs.com.tr\/blog\/?p=16610"},"modified":"2026-09-28T16:06:00","modified_gmt":"2026-09-28T13:06:00","slug":"dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma","status":"publish","type":"post","link":"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/","title":{"rendered":"DNSSEC ve DANE: DNS Seviyesinde SSL G\u00fcvenli\u011fini Art\u0131rma"},"content":{"rendered":"<p>\u0130nternet altyap\u0131s\u0131n\u0131n temel ta\u015flar\u0131 olan DNS (Alan Ad\u0131 Sistemi) ve SSL\/TLS (G\u00fcvenli Soket Katman\u0131\/Ta\u015f\u0131ma Katman\u0131 G\u00fcvenli\u011fi) protokolleri, dijital d\u00fcnyadaki ileti\u015fimimizin g\u00fcvenli\u011fini sa\u011flamak i\u00e7in kritik roller \u00fcstlenir. Ancak bu geleneksel sistemler, karma\u015f\u0131k ve s\u00fcrekli geli\u015fen siber tehditler kar\u015f\u0131s\u0131nda tek ba\u015flar\u0131na yeterli olamayabilirler. DNS sahtekarl\u0131\u011f\u0131, ortadaki adam sald\u0131r\u0131lar\u0131 ve Sertifika Otoritelerindeki (CA) g\u00fcven zafiyetleri gibi sorunlar, hem son kullan\u0131c\u0131lar\u0131n hem de i\u015fletmelerin veri g\u00fcvenli\u011fini ve marka itibar\u0131n\u0131 ciddi \u015fekilde tehdit etmektedir. Bu noktada, mevcut g\u00fcvenlik katmanlar\u0131n\u0131 g\u00fc\u00e7lendiren ve internetin g\u00fcven zincirini daha sa\u011flam hale getiren iki \u00f6nemli teknoloji devreye girer: DNSSEC (DNS Security Extensions) ve DANE (DNS-based Authentication of Named Entities). Bu makalede, geleneksel sistemlerin zafiyetlerini, DNSSEC ve DANE&#8217;in bu zafiyetleri nas\u0131l kapatt\u0131\u011f\u0131n\u0131, birlikte nas\u0131l \u00e7al\u0131\u015ft\u0131klar\u0131n\u0131 ve dijital ileti\u015fimimizi nas\u0131l daha g\u00fcvenli hale getirdiklerini detayl\u0131 bir \u015fekilde inceleyece\u011fiz.<\/p>\n<div id=\"ez-toc-container\" class=\"ez-toc-v2_0_77 counter-hierarchy ez-toc-counter ez-toc-grey ez-toc-container-direction\">\n<p class=\"ez-toc-title\" style=\"cursor:inherit\">\u0130\u00e7erik Tablosu<\/p>\n<label for=\"ez-toc-cssicon-toggle-item-6aba8a9388eae\" class=\"ez-toc-cssicon-toggle-label\"><span class=\"\"><span class=\"eztoc-hide\" style=\"display:none;\">Toggle<\/span><span class=\"ez-toc-icon-toggle-span\"><svg style=\"fill: #999;color:#999\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" class=\"list-377408\" width=\"20px\" height=\"20px\" viewBox=\"0 0 24 24\" fill=\"none\"><path d=\"M6 6H4v2h2V6zm14 0H8v2h12V6zM4 11h2v2H4v-2zm16 0H8v2h12v-2zM4 16h2v2H4v-2zm16 0H8v2h12v-2z\" fill=\"currentColor\"><\/path><\/svg><svg style=\"fill: #999;color:#999\" class=\"arrow-unsorted-368013\" xmlns=\"http:\/\/www.w3.org\/2000\/svg\" width=\"10px\" height=\"10px\" viewBox=\"0 0 24 24\" version=\"1.2\" baseProfile=\"tiny\"><path d=\"M18.2 9.3l-6.2-6.3-6.2 6.3c-.2.2-.3.4-.3.7s.1.5.3.7c.2.2.4.3.7.3h11c.3 0 .5-.1.7-.3.2-.2.3-.5.3-.7s-.1-.5-.3-.7zM5.8 14.7l6.2 6.3 6.2-6.3c.2-.2.3-.5.3-.7s-.1-.5-.3-.7c-.2-.2-.4-.3-.7-.3h-11c-.3 0-.5.1-.7.3-.2.2-.3.5-.3.7s.1.5.3.7z\"\/><\/svg><\/span><\/span><\/label><input type=\"checkbox\" id=\"ez-toc-cssicon-toggle-item-6aba8a9388eae\" aria-label=\"Toggle\" \/><nav><ul class='ez-toc-list ez-toc-list-level-1 ' ><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-1\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#Geleneksel-DNS-ve-SSLTLS-Sistemlerinin-Guvenlik-Zafiyetleri\" >Geleneksel DNS ve SSL\/TLS Sistemlerinin G\u00fcvenlik Zafiyetleri<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-2\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#DNS-Sahtekarligi-DNS-Spoofing-ve-Onbellek-Zehirlenmesi-Cache-Poisoning-Nedir\" >DNS Sahtekarl\u0131\u011f\u0131 (DNS Spoofing) ve \u00d6nbellek Zehirlenmesi (Cache Poisoning) Nedir?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-3\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#Ortadaki-Adam-Man-in-the-Middle-%E2%80%93-MitM-Saldirilarinin-Mekanizmasi\" >Ortadaki Adam (Man-in-the-Middle &#8211; MitM) Sald\u0131r\u0131lar\u0131n\u0131n Mekanizmas\u0131<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-4\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#Sertifika-Otoritesi-CA-Hiyerarsisindeki-Guven-Sorunlari-ve-Potansiyel-Riskler\" >Sertifika Otoritesi (CA) Hiyerar\u015fisindeki G\u00fcven Sorunlar\u0131 ve Potansiyel Riskler<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-5\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#Guvenlik-Aciklarinin-Son-Kullanici-ve-Isletmeler-Icin-Sonuclari\" >G\u00fcvenlik A\u00e7\u0131klar\u0131n\u0131n Son Kullan\u0131c\u0131 ve \u0130\u015fletmeler \u0130\u00e7in Sonu\u00e7lar\u0131<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-6\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#DNSSEC-DNS-Sorgularini-Dogrulama-ve-Guvence-Altina-Alma\" >DNSSEC: DNS Sorgular\u0131n\u0131 Do\u011frulama ve G\u00fcvence Alt\u0131na Alma<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-7\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#DNSSEC-Nedir-ve-Hangi-Temel-Sorunu-Cozer\" >DNSSEC Nedir ve Hangi Temel Sorunu \u00c7\u00f6zer?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-8\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#DNSSECin-Calisma-Prensibi-Dijital-Imzalar-ve-Guven-Zinciri-Chain-of-Trust\" >DNSSEC&#8217;in \u00c7al\u0131\u015fma Prensibi: Dijital \u0130mzalar ve G\u00fcven Zinciri (Chain of Trust)<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-9\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#Temel-DNSSEC-Kayit-Turleri-ve-Gorevleri\" >Temel DNSSEC Kay\u0131t T\u00fcrleri ve G\u00f6revleri<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-10\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#DNSSEC-Dogrulama-Sureci-Adim-Adim-Nasil-Isler\" >DNSSEC Do\u011frulama S\u00fcreci Ad\u0131m Ad\u0131m Nas\u0131l \u0130\u015fler?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-11\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#DNSSECin-Sagladigi-Avantajlar-ve-Sinirliliklari\" >DNSSEC&#8217;in Sa\u011flad\u0131\u011f\u0131 Avantajlar ve S\u0131n\u0131rl\u0131l\u0131klar\u0131<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-12\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#DANE-Protokolu-Sertifika-Otoritesi-Guven-Modelini-Gelistirme\" >DANE Protokol\u00fc: Sertifika Otoritesi G\u00fcven Modelini Geli\u015ftirme<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-13\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#DANE-Nedir-ve-Neden-Ihtiyac-Duyulur\" >DANE Nedir ve Neden \u0130htiya\u00e7 Duyulur?<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-14\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#DNSSEC-Bagimliligi-DANEin-Guvenli-Temeli\" >DNSSEC Ba\u011f\u0131ml\u0131l\u0131\u011f\u0131: DANE&#8217;in G\u00fcvenli Temeli<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-15\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#TLSA-Kaydi-DANEin-Yapi-Tasi-ve-Parametreleri\" >TLSA Kayd\u0131: DANE&#8217;in Yap\u0131 Ta\u015f\u0131 ve Parametreleri<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-16\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#DANE-ile-Geleneksel-CA-Hiyerarsisinin-Esnetilmesi-ve-Asilmasi\" >DANE ile Geleneksel CA Hiyerar\u015fisinin Esnetilmesi ve A\u015f\u0131lmas\u0131<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-17\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#DNSSEC-ve-DANEin-Birlikte-Calismasi-Katmanli-Guvenlik-Mimarisi\" >DNSSEC ve DANE&#8217;in Birlikte \u00c7al\u0131\u015fmas\u0131: Katmanl\u0131 G\u00fcvenlik Mimarisi<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-18\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#DNSSECin-Rolu-Guvenilir-Iletim-Kanali-Saglama\" >DNSSEC&#8217;in Rol\u00fc: G\u00fcvenilir \u0130letim Kanal\u0131 Sa\u011flama<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-19\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#DANEin-Rolu-Iletilen-Sertifikanin-veya-Anahtarin-Dogrulugunu-Teyit-Etme\" >DANE&#8217;in Rol\u00fc: \u0130letilen Sertifikan\u0131n veya Anahtar\u0131n Do\u011frulu\u011funu Teyit Etme<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-20\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#Pratikte-Bir-Web-Sitesi-Baglanti-Senaryosu-Tarayici-ve-Sunucu-Etkilesimi\" >Pratikte Bir Web Sitesi Ba\u011flant\u0131 Senaryosu: Taray\u0131c\u0131 ve Sunucu Etkile\u015fimi<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-21\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#E-posta-Guvenliginde-DNSSEC-ve-DANE-Kullanimi-SMTP-uzerinden-TLS\" >E-posta G\u00fcvenli\u011finde DNSSEC ve DANE Kullan\u0131m\u0131 (SMTP \u00fczerinden TLS)<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-22\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#DNSSEC-ve-DANE-Uygulamasi-ve-Yapilandirmasi\" >DNSSEC ve DANE Uygulamas\u0131 ve Yap\u0131land\u0131rmas\u0131<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-23\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#DNSSEC-ve-DANE-icin-On-Gereksinimler\" >DNSSEC ve DANE i\u00e7in \u00d6n Gereksinimler<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-24\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#Alan-Adi-Saglayicisi-Registrar-Tarafinda-DNSSEC-Aktivasyonu\" >Alan Ad\u0131 Sa\u011flay\u0131c\u0131s\u0131 (Registrar) Taraf\u0131nda DNSSEC Aktivasyonu<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-25\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#Sunucu-Tarafinda-DNSSEC-Anahtarlarinin-Olusturulmasi-ve-Yonetimi\" >Sunucu Taraf\u0131nda DNSSEC Anahtarlar\u0131n\u0131n Olu\u015fturulmas\u0131 ve Y\u00f6netimi<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-26\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#TLSA-Kaydi-Olusturma-ve-DNSe-Ekleme-Araclari\" >TLSA Kayd\u0131 Olu\u015fturma ve DNS&#8217;e Ekleme Ara\u00e7lar\u0131<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-27\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#Yapilandirma-Sonrasi-Dogrulama-ve-Test-Yontemleri\" >Yap\u0131land\u0131rma Sonras\u0131 Do\u011frulama ve Test Y\u00f6ntemleri<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-28\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#DNSSEC-ve-DANEin-Isletmeler-ve-Son-Kullanicilar-Icin-Pratik-Faydalari\" >DNSSEC ve DANE&#8217;in \u0130\u015fletmeler ve Son Kullan\u0131c\u0131lar \u0130\u00e7in Pratik Faydalar\u0131<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-29\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#Phishing-ve-Ortadaki-Adam-Saldirilarina-Karsi-Gelismis-Koruma\" >Phishing ve Ortadaki Adam Sald\u0131r\u0131lar\u0131na Kar\u015f\u0131 Geli\u015fmi\u015f Koruma<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-30\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#Marka-Itibari-ve-Musteri-Guveninin-Artirilmasi\" >Marka \u0130tibar\u0131 ve M\u00fc\u015fteri G\u00fcveninin Art\u0131r\u0131lmas\u0131<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-31\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#Sertifika-Otoritesi-Kaynakli-Guvenlik-Risklerinin-ve-Maliyetlerinin-Azaltilmasi\" >Sertifika Otoritesi Kaynakl\u0131 G\u00fcvenlik Risklerinin ve Maliyetlerinin Azalt\u0131lmas\u0131<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-32\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#E-posta-Iletisiminde-Sahtecilige-ve-Takibe-Karsi-Guvenligin-Saglanmasi\" >E-posta \u0130leti\u015fiminde Sahtecili\u011fe ve Takibe Kar\u015f\u0131 G\u00fcvenli\u011fin Sa\u011flanmas\u0131<\/a><\/li><\/ul><\/li><li class='ez-toc-page-1 ez-toc-heading-level-2'><a class=\"ez-toc-link ez-toc-heading-33\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#DNSSEC-DANE-ve-Alan-Adi-Guvenligi-Icin-Neden-IHS-Telekomu-Tercih-Etmelisiniz\" >DNSSEC, DANE ve Alan Ad\u0131 G\u00fcvenli\u011fi \u0130\u00e7in Neden \u0130HS Telekom&#8217;u Tercih Etmelisiniz?<\/a><ul class='ez-toc-list-level-3' ><li class='ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-34\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#Tek-Tikla-Kolay-DNSSEC-Aktivasyonu-ve-Yonetimi\" >Tek T\u0131kla Kolay DNSSEC Aktivasyonu ve Y\u00f6netimi<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-35\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#Uzman-Teknik-Destek-ve-Danismanlik-Hizmetleri\" >Uzman Teknik Destek ve Dan\u0131\u015fmanl\u0131k Hizmetleri<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-36\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#Guvenilir-Hizli-ve-Yuksek-Performansli-DNS-Altyapisi\" >G\u00fcvenilir, H\u0131zl\u0131 ve Y\u00fcksek Performansl\u0131 DNS Altyap\u0131s\u0131<\/a><\/li><li class='ez-toc-page-1 ez-toc-heading-level-3'><a class=\"ez-toc-link ez-toc-heading-37\" href=\"https:\/\/www.ihs.com.tr\/blog\/dnssec-ve-dane-dns-seviyesinde-ssl-guvenligini-artirma\/#Alan-Adi-Guvenliginiz-Icin-Uctan-Uca-Entegre-Cozumler\" >Alan Ad\u0131 G\u00fcvenli\u011finiz \u0130\u00e7in U\u00e7tan Uca Entegre \u00c7\u00f6z\u00fcmler<\/a><\/li><\/ul><\/li><\/ul><\/nav><\/div>\n<h2><span class=\"ez-toc-section\" id=\"Geleneksel-DNS-ve-SSLTLS-Sistemlerinin-Guvenlik-Zafiyetleri\"><\/span>Geleneksel DNS ve SSL\/TLS Sistemlerinin G\u00fcvenlik Zafiyetleri<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>\u0130nternetin temel i\u015flevselli\u011fi, kullan\u0131c\u0131lar\u0131n &#8220;google.com&#8221; gibi kolay hat\u0131rlanabilir alan adlar\u0131n\u0131, sunucular\u0131n anlad\u0131\u011f\u0131 IP adreslerine \u00e7eviren DNS sistemine ve bu sunucularla kullan\u0131c\u0131lar aras\u0131ndaki ileti\u015fimi \u015fifreleyen SSL\/TLS protokollerine dayan\u0131r. Ancak bu iki temel yap\u0131, do\u011falar\u0131 gere\u011fi baz\u0131 g\u00fcvenlik zafiyetlerine a\u00e7\u0131kt\u0131r. Bu zafiyetler, siber sald\u0131rganlar i\u00e7in \u00e7e\u015fitli sald\u0131r\u0131 vekt\u00f6rleri olu\u015fturarak hem bireysel kullan\u0131c\u0131lar\u0131 hem de kurumlar\u0131 riske atar.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"DNS-Sahtekarligi-DNS-Spoofing-ve-Onbellek-Zehirlenmesi-Cache-Poisoning-Nedir\"><\/span>DNS Sahtekarl\u0131\u011f\u0131 (DNS Spoofing) ve \u00d6nbellek Zehirlenmesi (Cache Poisoning) Nedir?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>DNS, do\u011fas\u0131 gere\u011fi g\u00fcvene dayal\u0131 bir sistemdir ve sorgular\u0131n do\u011frulu\u011funu kriptografik olarak teyit edecek bir mekanizmaya sahip de\u011fildir. Bu durum, iki temel sald\u0131r\u0131 t\u00fcr\u00fcne zemin haz\u0131rlar. <b>DNS Sahtekarl\u0131\u011f\u0131 (DNS Spoofing)<\/b>, sald\u0131rgan\u0131n bir DNS sunucusuna sahte yan\u0131tlar g\u00f6ndererek kullan\u0131c\u0131y\u0131 me\u015fru bir web sitesi yerine k\u00f6t\u00fc ama\u00e7l\u0131 bir siteye y\u00f6nlendirmesidir. \u00d6rne\u011fin, bankan\u0131z\u0131n web sitesine girmeye \u00e7al\u0131\u015f\u0131rken, fark\u0131nda olmadan kimlik bilgilerinizi \u00e7almak i\u00e7in tasarlanm\u0131\u015f sahte bir siteye y\u00f6nlendirilebilirsiniz. <b>\u00d6nbellek Zehirlenmesi (Cache Poisoning)<\/b> ise bu sald\u0131r\u0131n\u0131n daha geni\u015f kapsaml\u0131 bir t\u00fcr\u00fcd\u00fcr. Sald\u0131rgan, bir internet servis sa\u011flay\u0131c\u0131s\u0131n\u0131n veya kurumsal bir a\u011f\u0131n DNS \u00e7\u00f6z\u00fcmleyici (resolver) sunucusunun \u00f6nbelle\u011fine sahte bir DNS kayd\u0131 ekler. Bu durumda, o sunucuyu kullanan t\u00fcm kullan\u0131c\u0131lar, \u00f6nbellekteki sahte kay\u0131t temizlenene kadar k\u00f6t\u00fc ama\u00e7l\u0131 siteye y\u00f6nlendirilir, bu da sald\u0131r\u0131n\u0131n etkisini katbekat art\u0131r\u0131r.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Ortadaki-Adam-Man-in-the-Middle-%E2%80%93-MitM-Saldirilarinin-Mekanizmasi\"><\/span>Ortadaki Adam (Man-in-the-Middle &#8211; MitM) Sald\u0131r\u0131lar\u0131n\u0131n Mekanizmas\u0131<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Ortadaki Adam (MitM) sald\u0131r\u0131s\u0131, siber g\u00fcvenlikte en yayg\u0131n tehditlerden biridir. Bu sald\u0131r\u0131 t\u00fcr\u00fcnde, sald\u0131rgan kendini kullan\u0131c\u0131 ile ileti\u015fim kurdu\u011fu sunucu (\u00f6rne\u011fin bir web sitesi, e-posta sunucusu) aras\u0131na gizlice yerle\u015ftirir. Kullan\u0131c\u0131, do\u011frudan sunucuyla konu\u015ftu\u011funu zannederken asl\u0131nda t\u00fcm ileti\u015fim sald\u0131rgan \u00fczerinden ge\u00e7er. Sald\u0131rgan bu sayede, \u015fifrelenmemi\u015f verileri okuyabilir, \u015fifreli verileri \u00e7\u00f6zebilir, de\u011fi\u015ftirebilir ve taraflara yeniden \u015fifreleyerek g\u00f6nderebilir. \u00d6zellikle halka a\u00e7\u0131k Wi-Fi a\u011flar\u0131 gibi g\u00fcvensiz ortamlarda MitM sald\u0131r\u0131lar\u0131 olduk\u00e7a yayg\u0131nd\u0131r. Sald\u0131rgan, DNS sahtekarl\u0131\u011f\u0131 gibi y\u00f6ntemlerle trafi\u011fi kendi \u00fczerine \u00e7ekebilir ve ard\u0131ndan kullan\u0131c\u0131 ile sunucu aras\u0131ndaki t\u00fcm veri ak\u0131\u015f\u0131n\u0131 (kullan\u0131c\u0131 adlar\u0131, \u015fifreler, kredi kart\u0131 bilgileri) izleyebilir ve manip\u00fcle edebilir.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Sertifika-Otoritesi-CA-Hiyerarsisindeki-Guven-Sorunlari-ve-Potansiyel-Riskler\"><\/span>Sertifika Otoritesi (CA) Hiyerar\u015fisindeki G\u00fcven Sorunlar\u0131 ve Potansiyel Riskler<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>SSL\/TLS sisteminin temelini, bir web sitesinin kimli\u011fini do\u011frulayan dijital sertifikalar\u0131 d\u00fczenleyen Sertifika Otoriteleri (CA) olu\u015fturur. Taray\u0131c\u0131lar\u0131m\u0131z, y\u00fczlerce CA&#8217;ya &#8220;k\u00f6kten&#8221; g\u00fcvenir. Ancak bu merkezi g\u00fcven modeli baz\u0131 riskler bar\u0131nd\u0131r\u0131r. E\u011fer bir CA&#8217;n\u0131n sistemi ele ge\u00e7irilirse, sald\u0131rganlar bu CA ad\u0131na istedikleri herhangi bir <a href=\"https:\/\/www.ihs.com.tr\/blog\/domain-nedir-ne-ise-yarar\/\" target=\"_blank\">domain<\/a> i\u00e7in sahte <a href=\"https:\/\/www.ihs.com.tr\/ssl\/\" target=\"_blank\">SSL sertifikas\u0131<\/a> \u00fcretebilir. Taray\u0131c\u0131lar, bu sahte sertifikay\u0131 ge\u00e7erli kabul edece\u011fi i\u00e7in kullan\u0131c\u0131lar sahte bir siteye girdiklerini fark etmezler. Ge\u00e7mi\u015fte, DigiNotar ve Comodo gibi b\u00fcy\u00fck CA&#8217;lar\u0131n maruz kald\u0131\u011f\u0131 siber sald\u0131r\u0131lar, bu hiyerar\u015fik g\u00fcven modelinin ne kadar k\u0131r\u0131lgan olabilece\u011fini g\u00f6stermi\u015ftir. Tek bir CA&#8217;n\u0131n g\u00fcvenli\u011finin ihlal edilmesi, t\u00fcm internet ekosistemi i\u00e7in ciddi bir risk olu\u015fturabilir.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Guvenlik-Aciklarinin-Son-Kullanici-ve-Isletmeler-Icin-Sonuclari\"><\/span>G\u00fcvenlik A\u00e7\u0131klar\u0131n\u0131n Son Kullan\u0131c\u0131 ve \u0130\u015fletmeler \u0130\u00e7in Sonu\u00e7lar\u0131<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Bu g\u00fcvenlik zafiyetlerinin sonu\u00e7lar\u0131 hem son kullan\u0131c\u0131lar hem de i\u015fletmeler i\u00e7in y\u0131k\u0131c\u0131 olabilir. Son kullan\u0131c\u0131lar i\u00e7in en b\u00fcy\u00fck riskler; kimlik h\u0131rs\u0131zl\u0131\u011f\u0131, finansal kay\u0131plar (kredi kart\u0131 bilgilerinin \u00e7al\u0131nmas\u0131), ki\u015fisel verilerin if\u015fa olmas\u0131 ve k\u00f6t\u00fc ama\u00e7l\u0131 yaz\u0131l\u0131mlara maruz kalmakt\u0131r. \u0130\u015fletmeler i\u00e7in ise sonu\u00e7lar daha da ciddidir. Ba\u015far\u0131l\u0131 bir siber sald\u0131r\u0131, m\u00fc\u015fteri verilerinin s\u0131zmas\u0131na, finansal doland\u0131r\u0131c\u0131l\u0131\u011fa, marka itibar\u0131n\u0131n zedelenmesine ve m\u00fc\u015fteri g\u00fcveninin tamamen kaybedilmesine yol a\u00e7abilir. Bu durum, yasal yapt\u0131r\u0131mlar, para cezalar\u0131 ve uzun vadede pazar pay\u0131 kayb\u0131 gibi sonu\u00e7lar do\u011furabilir. Dolay\u0131s\u0131yla, bu geleneksel zafiyetlere kar\u015f\u0131 daha g\u00fc\u00e7l\u00fc savunma mekanizmalar\u0131 geli\u015ftirmek ka\u00e7\u0131n\u0131lmaz bir ihtiya\u00e7t\u0131r.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"DNSSEC-DNS-Sorgularini-Dogrulama-ve-Guvence-Altina-Alma\"><\/span>DNSSEC: DNS Sorgular\u0131n\u0131 Do\u011frulama ve G\u00fcvence Alt\u0131na Alma<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Geleneksel DNS sisteminin en b\u00fcy\u00fck zafiyeti, sorgu yan\u0131tlar\u0131n\u0131n do\u011frulu\u011funu ve b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc garanti edememesidir. Bu durum, DNS sahtekarl\u0131\u011f\u0131 ve \u00f6nbellek zehirlenmesi gibi sald\u0131r\u0131lara kap\u0131 aralar. \u0130\u015fte bu kritik g\u00fcvenlik a\u00e7\u0131\u011f\u0131n\u0131 kapatmak i\u00e7in geli\u015ftirilen DNSSEC (Domain Name System Security Extensions), DNS verilerinin kriptografik olarak imzalanarak do\u011frulanmas\u0131n\u0131 sa\u011flayan bir dizi protokold\u00fcr. DNSSEC, DNS&#8217;e bir g\u00fcvenlik katman\u0131 ekleyerek internetin temel g\u00fcven zincirini g\u00fc\u00e7lendirir.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"DNSSEC-Nedir-ve-Hangi-Temel-Sorunu-Cozer\"><\/span>DNSSEC Nedir ve Hangi Temel Sorunu \u00c7\u00f6zer?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>DNSSEC, en basit tan\u0131m\u0131yla, bir DNS \u00e7\u00f6z\u00fcmleyicisinin (resolver) ald\u0131\u011f\u0131 DNS yan\u0131t\u0131n\u0131n, ger\u00e7ekten yetkili DNS sunucusundan geldi\u011fini ve yolculu\u011fu s\u0131ras\u0131nda de\u011fi\u015ftirilmedi\u011fini do\u011frulamas\u0131n\u0131 sa\u011flayan bir teknolojidir. Temelde iki sorunu \u00e7\u00f6zer: <b>Veri B\u00fct\u00fcnl\u00fc\u011f\u00fc<\/b> ve <b>Kaynak Do\u011frulamas\u0131<\/b>. Veri b\u00fct\u00fcnl\u00fc\u011f\u00fc, al\u0131nan DNS kayd\u0131n\u0131n (\u00f6rne\u011fin, bir IP adresi) olu\u015fturuldu\u011fu andan itibaren de\u011fi\u015ftirilmedi\u011fini garanti eder. Kaynak do\u011frulamas\u0131 ise bu kayd\u0131n ger\u00e7ekten o alan ad\u0131n\u0131n sahibi taraf\u0131ndan yetkilendirilmi\u015f bir sunucudan geldi\u011fini teyit eder. DNSSEC&#8217;in bir \u015fifreleme protokol\u00fc olmad\u0131\u011f\u0131n\u0131, yani DNS sorgular\u0131n\u0131 gizlemedi\u011fini, sadece onlar\u0131n orijinalli\u011fini ve b\u00fct\u00fcnl\u00fc\u011f\u00fcn\u00fc sa\u011flad\u0131\u011f\u0131n\u0131 unutmamak \u00f6nemlidir.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"DNSSECin-Calisma-Prensibi-Dijital-Imzalar-ve-Guven-Zinciri-Chain-of-Trust\"><\/span>DNSSEC&#8217;in \u00c7al\u0131\u015fma Prensibi: Dijital \u0130mzalar ve G\u00fcven Zinciri (Chain of Trust)<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>DNSSEC&#8217;in \u00e7al\u0131\u015fma prensibi, a\u00e7\u0131k anahtarl\u0131 \u015fifreleme ve dijital imzalara dayan\u0131r. Bir <a href=\"https:\/\/www.ihs.com.tr\/domain\/alan-adi-domain-tescili.html\" target=\"_blank\">alan ad\u0131<\/a> sahibi, DNS kay\u0131tlar\u0131n\u0131 (A, MX, CNAME vb.) kendi \u00f6zel anahtar\u0131 (private key) ile dijital olarak imzalar. Bu imzalar, RRSIG ad\u0131 verilen yeni bir DNS kay\u0131t t\u00fcr\u00fcnde saklan\u0131r. Alan ad\u0131n\u0131n a\u00e7\u0131k anahtar\u0131 (public key) ise DNSKEY kayd\u0131 olarak yine DNS&#8217;te yay\u0131nlan\u0131r. Bir DNS \u00e7\u00f6z\u00fcmleyicisi, bu kay\u0131tlar\u0131 sorgulad\u0131\u011f\u0131nda, DNSKEY kayd\u0131ndaki a\u00e7\u0131k anahtar\u0131 kullanarak RRSIG kayd\u0131ndaki imzay\u0131 do\u011frular. E\u011fer imza ge\u00e7erliyse, al\u0131nan verinin do\u011fru ve de\u011fi\u015ftirilmemi\u015f oldu\u011fu anla\u015f\u0131l\u0131r. Bu do\u011frulama i\u015flemi, <b>G\u00fcven Zinciri (Chain of Trust)<\/b> ad\u0131 verilen hiyerar\u015fik bir yap\u0131da ger\u00e7ekle\u015fir. Her alan ad\u0131, bir \u00fcst seviyedeki alan ad\u0131n\u0131n (\u00f6rne\u011fin `.com.tr` i\u00e7in `.tr`) anahtar\u0131yla do\u011frulan\u0131r. Bu zincir, internetin en tepesindeki k\u00f6k (root) DNS sunucular\u0131na kadar devam eder. \u00c7\u00f6z\u00fcmleyici, bu zinciri takip ederek en tepedeki g\u00fcvenilir k\u00f6k anahtar\u0131na ula\u015fana kadar her ad\u0131m\u0131 do\u011frular.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Temel-DNSSEC-Kayit-Turleri-ve-Gorevleri\"><\/span>Temel DNSSEC Kay\u0131t T\u00fcrleri ve G\u00f6revleri<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>DNSSEC, i\u015flevselli\u011fini sa\u011flamak i\u00e7in DNS sistemine yeni kay\u0131t t\u00fcrleri ekler. Bu kay\u0131tlar, imzalama ve do\u011frulama s\u00fcre\u00e7lerinin temel yap\u0131 ta\u015flar\u0131d\u0131r.<\/p>\n<h4>RRSIG (Resource Record Signature)<\/h4>\n<p>Bir DNS kayd\u0131n\u0131n (\u00f6rne\u011fin A, MX) dijital imzas\u0131n\u0131 i\u00e7erir. Bir \u00e7\u00f6z\u00fcmleyici, bir A kayd\u0131 istedi\u011finde, sunucu hem A kayd\u0131n\u0131 hem de bu kayd\u0131n RRSIG imzas\u0131n\u0131 g\u00f6nderir. \u00c7\u00f6z\u00fcmleyici, bu imzay\u0131 do\u011frulayarak A kayd\u0131n\u0131n ge\u00e7erlili\u011fini teyit eder.<\/p>\n<h4>DNSKEY (DNS Public Key)<\/h4>\n<p>Alan ad\u0131n\u0131n dijital imzalar\u0131n\u0131 do\u011frulamak i\u00e7in kullan\u0131lan a\u00e7\u0131k anahtar\u0131 (public key) i\u00e7erir. Genellikle iki t\u00fcr DNSKEY bulunur: Anahtar \u0130mzalama Anahtar\u0131 (Key Signing Key &#8211; KSK) ve B\u00f6lge \u0130mzalama Anahtar\u0131 (Zone Signing Key &#8211; ZSK).<\/p>\n<h4>DS (Delegation Signer)<\/h4>\n<p>G\u00fcven zincirini olu\u015fturan en \u00f6nemli kay\u0131tlardan biridir. Bir alt alan ad\u0131n\u0131n (child zone) DNSKEY kayd\u0131n\u0131n \u00f6zetini (hash) i\u00e7erir ve \u00fcst alan ad\u0131 (parent zone) taraf\u0131ndan imzalan\u0131r. Bu kay\u0131t, bir alan ad\u0131ndan onun alt alan ad\u0131na g\u00fcvenli bir devir (delegation) yap\u0131lmas\u0131n\u0131 sa\u011flar. \u00d6rne\u011fin, `ihs.com.tr` alan ad\u0131n\u0131n DS kayd\u0131, `.com.tr` DNS b\u00f6lgesi i\u00e7inde yer al\u0131r.<\/p>\n<h4>NSEC\/NSEC3 (Next Secure)<\/h4>\n<p>Bir alan ad\u0131n\u0131n var olmad\u0131\u011f\u0131n\u0131 kriptografik olarak kan\u0131tlamak i\u00e7in kullan\u0131l\u0131r. Birisi mevcut olmayan bir subdomain&#8217;i (\u00f6rne\u011fin `yok.ihs.com.tr`) sorgulad\u0131\u011f\u0131nda, DNSSEC&#8217;li bir sunucu, alfabetik olarak bu isimden \u00f6nce ve sonra gelen ge\u00e7erli kay\u0131tlar\u0131 i\u00e7eren imzal\u0131 bir NSEC kayd\u0131 d\u00f6nd\u00fcr\u00fcr. Bu, \u00e7\u00f6z\u00fcmleyiciye istenen kayd\u0131n ger\u00e7ekten var olmad\u0131\u011f\u0131n\u0131 ve bunun bir sald\u0131r\u0131 olmad\u0131\u011f\u0131n\u0131 kan\u0131tlar.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"DNSSEC-Dogrulama-Sureci-Adim-Adim-Nasil-Isler\"><\/span>DNSSEC Do\u011frulama S\u00fcreci Ad\u0131m Ad\u0131m Nas\u0131l \u0130\u015fler?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Bir kullan\u0131c\u0131n\u0131n taray\u0131c\u0131s\u0131 `www.example.com` adresini \u00e7\u00f6z\u00fcmlemek istedi\u011finde DNSSEC do\u011frulama s\u00fcreci \u015fu \u015fekilde i\u015fler:<\/p>\n<ol>\n<li>Kullan\u0131c\u0131n\u0131n cihaz\u0131, yerel DNS \u00e7\u00f6z\u00fcmleyicisine (genellikle internet servis sa\u011flay\u0131c\u0131s\u0131n\u0131n sunucusu) bir sorgu g\u00f6nderir.<\/li>\n<li>\u00c7\u00f6z\u00fcmleyici, k\u00f6k sunuculardan ba\u015flayarak `.com` ve ard\u0131ndan `example.com` sunucular\u0131na kadar sorguyu ilerletir.<\/li>\n<li>`example.com` yetkili sunucusu, `www` i\u00e7in A kayd\u0131n\u0131, bu kayd\u0131n RRSIG imzas\u0131n\u0131 ve `example.com`&#8217;un DNSKEY kayd\u0131n\u0131 \u00e7\u00f6z\u00fcmleyiciye g\u00f6nderir.<\/li>\n<li>\u00c7\u00f6z\u00fcmleyici, DNSKEY&#8217;deki a\u00e7\u0131k anahtar\u0131 kullanarak RRSIG imzas\u0131n\u0131 do\u011frular. B\u00f6ylece A kayd\u0131n\u0131n `example.com` sunucusunda de\u011fi\u015ftirilmedi\u011finden emin olur.<\/li>\n<li>Ard\u0131ndan \u00e7\u00f6z\u00fcmleyici, `.com` sunucusuna giderek `example.com`&#8217;un DS kayd\u0131n\u0131 ister ve bu kayd\u0131 kullanarak `example.com`&#8217;un DNSKEY&#8217;inin ge\u00e7erli olup olmad\u0131\u011f\u0131n\u0131 kontrol eder.<\/li>\n<li>Bu i\u015flem, g\u00fcvenilir k\u00f6k anahtar\u0131na ula\u015fana kadar hiyerar\u015fik olarak devam eder.<\/li>\n<li>T\u00fcm zincir ba\u015far\u0131yla do\u011frulan\u0131rsa, \u00e7\u00f6z\u00fcmleyici IP adresini kullan\u0131c\u0131n\u0131n cihaz\u0131na g\u00fcvenli bir \u015fekilde g\u00f6nderir. Herhangi bir ad\u0131mda imza do\u011frulanamazsa, sorgu ba\u015far\u0131s\u0131z olur ve kullan\u0131c\u0131 potansiyel bir sald\u0131r\u0131dan korunmu\u015f olur.<\/li>\n<\/ol>\n<h3><span class=\"ez-toc-section\" id=\"DNSSECin-Sagladigi-Avantajlar-ve-Sinirliliklari\"><\/span>DNSSEC&#8217;in Sa\u011flad\u0131\u011f\u0131 Avantajlar ve S\u0131n\u0131rl\u0131l\u0131klar\u0131<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>DNSSEC, internet altyap\u0131s\u0131n\u0131 \u00f6nemli \u00f6l\u00e7\u00fcde daha g\u00fcvenli hale getirir, ancak her teknolojide oldu\u011fu gibi baz\u0131 s\u0131n\u0131rl\u0131l\u0131klara da sahiptir.<\/p>\n<div class=\"karsilastirma\">\n<table>\n<thead>\n<tr>\n<th>Avantajlar<\/th>\n<th>S\u0131n\u0131rl\u0131l\u0131klar<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><b>DNS Sahtekarl\u0131\u011f\u0131 ve \u00d6nbellek Zehirlenmesine Kar\u015f\u0131 Koruma:<\/b> DNS yan\u0131tlar\u0131n\u0131n do\u011frulanmas\u0131, bu t\u00fcr sald\u0131r\u0131lar\u0131 etkili bir \u015fekilde engeller.<\/td>\n<td><b>Gizlilik Sa\u011flamaz:<\/b> DNS sorgu ve yan\u0131tlar\u0131n\u0131 \u015fifrelemez. Bu i\u015flem i\u00e7in DoH (DNS over HTTPS) veya DoT (DNS over TLS) gibi teknolojiler gereklidir.<\/td>\n<\/tr>\n<tr>\n<td><b>Veri B\u00fct\u00fcnl\u00fc\u011f\u00fc ve Orijinalli\u011fi:<\/b> Al\u0131nan DNS verisinin de\u011fi\u015ftirilmedi\u011fini ve do\u011fru kaynaktan geldi\u011fini garanti eder.<\/td>\n<td><b>Artan Karma\u015f\u0131kl\u0131k:<\/b> Yap\u0131land\u0131rmas\u0131 ve y\u00f6netimi, geleneksel DNS&#8217;e g\u00f6re daha karma\u015f\u0131kt\u0131r. Anahtar y\u00f6netimi dikkat gerektirir.<\/td>\n<\/tr>\n<tr>\n<td><b>Di\u011fer G\u00fcvenlik Protokollerine Temel Olu\u015fturma:<\/b> DANE gibi daha geli\u015fmi\u015f g\u00fcvenlik protokollerinin \u00e7al\u0131\u015fmas\u0131 i\u00e7in g\u00fcvenilir bir zemin sa\u011flar.<\/td>\n<td><b>Yanl\u0131\u015f Yap\u0131land\u0131rma Riski:<\/b> Hatal\u0131 bir DNSSEC yap\u0131land\u0131rmas\u0131, alan ad\u0131n\u0131n internetten tamamen eri\u015filemez hale gelmesine neden olabilir.<\/td>\n<\/tr>\n<tr>\n<td><b>G\u00fcven Zinciri:<\/b> \u0130nternetin k\u00f6k\u00fcnden alan ad\u0131na kadar uzanan k\u0131r\u0131lmaz bir g\u00fcven modeli olu\u015fturur.<\/td>\n<td><b>DDoS Y\u00fckseltme Sald\u0131r\u0131lar\u0131 Potansiyeli:<\/b> DNSSEC yan\u0131tlar\u0131 daha b\u00fcy\u00fck oldu\u011fu i\u00e7in, baz\u0131 durumlarda DDoS (Da\u011f\u0131t\u0131k Hizmet Engelleme) sald\u0131r\u0131lar\u0131nda bir y\u00fckseltme (amplification) fakt\u00f6r\u00fc olarak kullan\u0131labilir.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h2><span class=\"ez-toc-section\" id=\"DANE-Protokolu-Sertifika-Otoritesi-Guven-Modelini-Gelistirme\"><\/span>DANE Protokol\u00fc: Sertifika Otoritesi G\u00fcven Modelini Geli\u015ftirme<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>DNSSEC, DNS verilerinin g\u00fcvenilir bir \u015fekilde iletilmesini sa\u011flayarak temel bir sorunu \u00e7\u00f6zer. Ancak bu verilerle ne yap\u0131ld\u0131\u011f\u0131, yani bir web sitesine ba\u011flan\u0131rken kullan\u0131lan <a href=\"https:\/\/www.ihs.com.tr\/blog\/ssl-sertifikasi-nedir-onemlidir\/\" target=\"_blank\">SSL sertifikas\u0131<\/a>n\u0131n do\u011frulu\u011fu, geleneksel olarak Sertifika Otoritesi (CA) hiyerar\u015fisine ba\u011fl\u0131d\u0131r. DANE (DNS-based Authentication of Named Entities) protokol\u00fc, bu noktada devreye girerek CA&#8217;lara olan mutlak ba\u011f\u0131ml\u0131l\u0131\u011f\u0131 azalt\u0131r ve sertifika do\u011frulama s\u00fcrecini DNS&#8217;in g\u00fcvenli altyap\u0131s\u0131 \u00fczerine in\u015fa eder.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"DANE-Nedir-ve-Neden-Ihtiyac-Duyulur\"><\/span>DANE Nedir ve Neden \u0130htiya\u00e7 Duyulur?<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>DANE, bir alan ad\u0131n\u0131n SSL\/TLS sertifikas\u0131n\u0131 veya bu sertifikay\u0131 imzalamas\u0131 gereken CA&#8217;y\u0131, g\u00fcvenli DNS (yani DNSSEC ile korunan DNS) arac\u0131l\u0131\u011f\u0131yla do\u011frudan belirtmesine olanak tan\u0131yan bir internet g\u00fcvenlik protokol\u00fcd\u00fcr. Geleneksel modelde, taray\u0131c\u0131n\u0131z bir web sitesine ba\u011fland\u0131\u011f\u0131nda, o sitenin sertifikas\u0131n\u0131n g\u00fcvenilir bir CA taraf\u0131ndan imzalan\u0131p imzalanmad\u0131\u011f\u0131n\u0131 kontrol eder. DANE ile taray\u0131c\u0131, ek bir do\u011frulama ad\u0131m\u0131 olarak DNS&#8217;ten ilgili alan ad\u0131 i\u00e7in yay\u0131nlanm\u0131\u015f olan TLSA kayd\u0131n\u0131 sorgular. Bu kay\u0131t, taray\u0131c\u0131ya sunucudan beklenen sertifikan\u0131n ne oldu\u011funu veya hangi CA taraf\u0131ndan imzalanmas\u0131 gerekti\u011fini s\u00f6yler. Bu mekanizma, sahte sertifikalarla yap\u0131lan Ortadaki Adam (MitM) sald\u0131r\u0131lar\u0131na ve CA sistemlerinin ele ge\u00e7irilmesi riskine kar\u015f\u0131 g\u00fc\u00e7l\u00fc bir savunma katman\u0131 ekler.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"DNSSEC-Bagimliligi-DANEin-Guvenli-Temeli\"><\/span>DNSSEC Ba\u011f\u0131ml\u0131l\u0131\u011f\u0131: DANE&#8217;in G\u00fcvenli Temeli<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>DANE&#8217;in \u00e7al\u0131\u015fabilmesi i\u00e7in DNSSEC mutlak bir \u00f6n ko\u015fuldur. \u00c7\u00fcnk\u00fc DANE, sertifika bilgilerini TLSA ad\u0131 verilen \u00f6zel bir DNS kayd\u0131nda saklar. E\u011fer bu DNS kayd\u0131n\u0131n kendisi g\u00fcvenli de\u011filse, yani bir sald\u0131rgan taraf\u0131ndan de\u011fi\u015ftirilebiliyorsa, DANE protokol\u00fcn\u00fcn hi\u00e7bir anlam\u0131 kalmaz. Sald\u0131rgan, hem sahte bir sertifika olu\u015fturup hem de bu sahte sertifikaya uyan sahte bir TLSA kayd\u0131n\u0131 DNS \u00f6nbelle\u011fine yerle\u015ftirerek sald\u0131r\u0131s\u0131n\u0131 ger\u00e7ekle\u015ftirebilir. DNSSEC, TLSA kayd\u0131n\u0131n dijital olarak imzalanarak do\u011frulanmas\u0131n\u0131 sa\u011flar. Bu sayede taray\u0131c\u0131, DNS&#8217;ten ald\u0131\u011f\u0131 TLSA kayd\u0131n\u0131n ger\u00e7ekten alan ad\u0131 sahibi taraf\u0131ndan yay\u0131nland\u0131\u011f\u0131ndan ve de\u011fi\u015ftirilmedi\u011finden emin olur. K\u0131sacas\u0131, DNSSEC g\u00fcvenli ta\u015f\u0131ma kanal\u0131n\u0131, DANE ise bu kanaldan iletilen sertifika do\u011frulama bilgisini sa\u011flar.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"TLSA-Kaydi-DANEin-Yapi-Tasi-ve-Parametreleri\"><\/span>TLSA Kayd\u0131: DANE&#8217;in Yap\u0131 Ta\u015f\u0131 ve Parametreleri<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>DANE&#8217;in kalbinde TLSA kayd\u0131 bulunur. Bu kay\u0131t, bir alan ad\u0131 i\u00e7in sertifika ili\u015fkilendirmesini tan\u0131mlayan d\u00f6rt temel parametreden olu\u015fur. Bu parametreler, taray\u0131c\u0131ya sertifikay\u0131 nas\u0131l do\u011frulamas\u0131 gerekti\u011fini ad\u0131m ad\u0131m anlat\u0131r.<\/p>\n<h4>Sertifika Kullan\u0131m\u0131 (Certificate Usage): PKIX-TA, PKIX-EE, DANE-TA, DANE-EE<\/h4>\n<p>Bu alan, DANE&#8217;in ne kadar k\u0131s\u0131tlay\u0131c\u0131 olaca\u011f\u0131n\u0131 ve geleneksel CA modeline ne kadar ba\u011fl\u0131 kalaca\u011f\u0131n\u0131 belirler. D\u00f6rt temel de\u011feri vard\u0131r:<\/p>\n<div class=\"karsilastirma\">\n<table>\n<thead>\n<tr>\n<th>De\u011fer<\/th>\n<th>A\u00e7\u0131klama<\/th>\n<th>Kullan\u0131m Senaryosu<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td><b>0 &#8211; PKIX-TA<\/b><\/td>\n<td>Sunucunun sertifika zincirinin, TLSA kayd\u0131nda belirtilen CA ile sonlanmas\u0131 gerekti\u011fini belirtir. Geleneksel PKI (Public Key Infrastructure) hiyerar\u015fisine g\u00fcvenir ancak belirli bir CA&#8217;y\u0131 zorunlu k\u0131lar.<\/td>\n<td>Yaln\u0131zca belirli bir Sertifika Otoritesine g\u00fcvendi\u011finizi ve ba\u015fka hi\u00e7bir CA taraf\u0131ndan verilen sertifikan\u0131n kabul edilmeyece\u011fini belirtmek i\u00e7in kullan\u0131l\u0131r.<\/td>\n<\/tr>\n<tr>\n<td><b>1 &#8211; PKIX-EE<\/b><\/td>\n<td>Sunucunun sundu\u011fu son kullan\u0131c\u0131 (end-entity) sertifikas\u0131n\u0131n, TLSA kayd\u0131nda belirtilen sertifika ile e\u015fle\u015fmesi gerekti\u011fini belirtir. Bu sertifika yine ge\u00e7erli bir CA taraf\u0131ndan imzalanm\u0131\u015f olmal\u0131d\u0131r.<\/td>\n<td>&#8220;Sertifika Sabitleme&#8221; (Certificate Pinning) olarak bilinir. Belirli bir sertifikay\u0131 DNS&#8217;e sabitleyerek sahte sertifika kullan\u0131m\u0131n\u0131 engeller.<\/td>\n<\/tr>\n<tr>\n<td><b>2 &#8211; DANE-TA<\/b><\/td>\n<td>PKIX-TA&#8217;ya benzer \u015fekilde bir g\u00fcven \u00e7apas\u0131 (trust anchor) belirtir, ancak bu \u00e7apan\u0131n geleneksel CA hiyerar\u015fisinde yer almas\u0131 zorunlu de\u011fildir. \u00d6zel veya kendi kendine imzalanm\u0131\u015f bir CA olabilir.<\/td>\n<td>Kurulu\u015flar\u0131n kendi \u00f6zel CA&#8217;lar\u0131n\u0131 kullanarak sertifika yay\u0131nlamas\u0131na ve bunlar\u0131 DANE ile do\u011frulamas\u0131na olanak tan\u0131r.<\/td>\n<\/tr>\n<tr>\n<td><b>3 &#8211; DANE-EE<\/b><\/td>\n<td>PKIX-EE&#8217;ye benzer \u015fekilde son kullan\u0131c\u0131 sertifikas\u0131n\u0131 belirtir, ancak bu sertifikan\u0131n bilinen bir CA taraf\u0131ndan imzalanmas\u0131 gerekmez. Kendi kendine imzalanm\u0131\u015f (self-signed) bir sertifika olabilir.<\/td>\n<td>CA maliyetlerinden tamamen ka\u00e7\u0131nmak ve sertifika y\u00f6netimini tamamen kendi kontrol\u00fcne almak isteyenler i\u00e7in idealdir.<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<\/div>\n<h4>Se\u00e7ici (Selector): Sertifikan\u0131n Hangi B\u00f6l\u00fcm\u00fcn\u00fcn Do\u011frulanaca\u011f\u0131<\/h4>\n<p>Bu parametre, TLSA kayd\u0131ndaki verinin, sunucudan al\u0131nan sertifikan\u0131n hangi b\u00f6l\u00fcm\u00fcyle kar\u015f\u0131la\u015ft\u0131r\u0131laca\u011f\u0131n\u0131 belirler. \u0130ki yayg\u0131n de\u011feri vard\u0131r:<\/p>\n<ul>\n<li><b>0 &#8211; Full Certificate:<\/b> Kar\u015f\u0131la\u015ft\u0131rma i\u00e7in sunucudan gelen sertifikan\u0131n tamam\u0131 kullan\u0131l\u0131r.<\/li>\n<li><b>1 &#8211; SubjectPublicKeyInfo:<\/b> Kar\u015f\u0131la\u015ft\u0131rma i\u00e7in sertifikan\u0131n sadece a\u00e7\u0131k anahtar (public key) b\u00f6l\u00fcm\u00fc kullan\u0131l\u0131r. Bu, sertifika yenilendi\u011finde ayn\u0131 anahtar \u00e7ifti kullan\u0131l\u0131yorsa TLSA kayd\u0131n\u0131 de\u011fi\u015ftirmeye gerek b\u0131rakmad\u0131\u011f\u0131 i\u00e7in daha esnek bir y\u00f6ntemdir.<\/li>\n<\/ul>\n<h4>E\u015fle\u015fme T\u00fcr\u00fc (Matching Type): Hash Algoritmas\u0131n\u0131n Belirlenmesi<\/h4>\n<p>Bu parametre, se\u00e7ici taraf\u0131ndan belirlenen sertifika verisinin nas\u0131l i\u015flenece\u011fini tan\u0131mlar. \u00dc\u00e7 de\u011feri vard\u0131r:<\/p>\n<ul>\n<li><b>0 &#8211; No Hash:<\/b> Veri oldu\u011fu gibi, ham haliyle kar\u015f\u0131la\u015ft\u0131r\u0131l\u0131r.<\/li>\n<li><b>1 &#8211; SHA-256:<\/b> Verinin SHA-256 \u00f6zeti (hash) al\u0131n\u0131r ve bu \u00f6zet kar\u015f\u0131la\u015ft\u0131r\u0131l\u0131r. En yayg\u0131n kullan\u0131lan y\u00f6ntemdir.<\/li>\n<li><b>2 &#8211; SHA-512:<\/b> Verinin SHA-512 \u00f6zeti al\u0131n\u0131r ve kar\u015f\u0131la\u015ft\u0131r\u0131l\u0131r. Daha g\u00fc\u00e7l\u00fc bir hash algoritmas\u0131d\u0131r.<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"DANE-ile-Geleneksel-CA-Hiyerarsisinin-Esnetilmesi-ve-Asilmasi\"><\/span>DANE ile Geleneksel CA Hiyerar\u015fisinin Esnetilmesi ve A\u015f\u0131lmas\u0131<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>DANE protokol\u00fc, internetin g\u00fcven modelinde devrim niteli\u011finde bir esneklik sunar. Geleneksel modelde, ya y\u00fczlerce CA&#8217;n\u0131n tamam\u0131na g\u00fcvenirsiniz ya da hi\u00e7birine g\u00fcvenmezsiniz. DANE ile alan ad\u0131 sahipleri, bu g\u00fcveni kendi ihtiya\u00e7lar\u0131na g\u00f6re \u015fekillendirebilir. &#8220;Certificate Usage&#8221; alan\u0131ndaki farkl\u0131 se\u00e7enekler sayesinde, bir <a href=\"https:\/\/www.ihs.com.tr\/domain-sahibi-sorgulama\/\" target=\"_blank\">domain sahibi sorgulama<\/a> sonucunda, sitenin yaln\u0131zca belirli bir CA&#8217;dan gelen sertifikalar\u0131 kabul etmesini zorunlu k\u0131labilir (PKIX-TA), kendi olu\u015fturdu\u011fu \u00f6zel bir sertifikay\u0131 kullanabilir (DANE-EE) veya belirli bir sertifikay\u0131 DNS&#8217;e sabitleyerek sahte sertifika riskini ortadan kald\u0131rabilir (PKIX-EE). Bu, g\u00fcven kontrol\u00fcn\u00fc merkezi otoritelerden al\u0131p do\u011frudan alan ad\u0131n\u0131n sahibine vererek interneti daha adem-i merkeziyet\u00e7i ve potansiyel olarak daha g\u00fcvenli bir yap\u0131ya kavu\u015fturur.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"DNSSEC-ve-DANEin-Birlikte-Calismasi-Katmanli-Guvenlik-Mimarisi\"><\/span>DNSSEC ve DANE&#8217;in Birlikte \u00c7al\u0131\u015fmas\u0131: Katmanl\u0131 G\u00fcvenlik Mimarisi<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>DNSSEC ve DANE, tek ba\u015flar\u0131na \u00f6nemli g\u00fcvenlik sorunlar\u0131n\u0131 \u00e7\u00f6zen iki g\u00fc\u00e7l\u00fc protokold\u00fcr. Ancak ger\u00e7ek potansiyelleri, bir araya geldiklerinde ortaya \u00e7\u0131kar. Bu iki teknoloji, birbirini tamamlayan bir katmanl\u0131 g\u00fcvenlik mimarisi olu\u015fturarak DNS seviyesinden uygulama katman\u0131na kadar uzanan kesintisiz bir g\u00fcven zinciri meydana getirir. Bu mimari, internet ileti\u015fiminin temelden uca kadar do\u011frulanmas\u0131n\u0131 ve g\u00fcvence alt\u0131na al\u0131nmas\u0131n\u0131 sa\u011flar.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"DNSSECin-Rolu-Guvenilir-Iletim-Kanali-Saglama\"><\/span>DNSSEC&#8217;in Rol\u00fc: G\u00fcvenilir \u0130letim Kanal\u0131 Sa\u011flama<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Bu ortak mimaride DNSSEC&#8217;in rol\u00fc, temeli atmakt\u0131r. DNSSEC, DANE&#8217;in ihtiya\u00e7 duydu\u011fu g\u00fcvenilir ve do\u011frulanabilir ileti\u015fim kanal\u0131n\u0131 olu\u015fturur. Bir istemci (\u00f6rne\u011fin bir web taray\u0131c\u0131s\u0131 veya e-posta sunucusu) bir alan ad\u0131n\u0131n DANE bilgilerini (TLSA kayd\u0131n\u0131) sorgulad\u0131\u011f\u0131nda, bu bilginin ger\u00e7ekten o alan ad\u0131n\u0131n yetkili sunucusundan geldi\u011finden ve aktar\u0131m s\u0131ras\u0131nda de\u011fi\u015ftirilmedi\u011finden emin olmas\u0131 gerekir. \u0130\u015fte bu garantiyi DNSSEC sa\u011flar. DNSSEC olmadan, bir sald\u0131rgan DNS sorgusunu manip\u00fcle ederek sahte bir TLSA kayd\u0131 d\u00f6nd\u00fcrebilir ve DANE&#8217;in t\u00fcm g\u00fcvenlik mekanizmas\u0131n\u0131 atlatabilir. Dolay\u0131s\u0131yla DNSSEC, DANE&#8217;in \u00fczerine in\u015fa edildi\u011fi &#8220;g\u00fcvenilir DNS&#8221; katman\u0131d\u0131r.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"DANEin-Rolu-Iletilen-Sertifikanin-veya-Anahtarin-Dogrulugunu-Teyit-Etme\"><\/span>DANE&#8217;in Rol\u00fc: \u0130letilen Sertifikan\u0131n veya Anahtar\u0131n Do\u011frulu\u011funu Teyit Etme<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>DNSSEC taraf\u0131ndan g\u00fcvenli bir \u015fekilde temeli at\u0131ld\u0131ktan sonra, DANE sahneye \u00e7\u0131kar. DANE&#8217;in rol\u00fc, DNSSEC arac\u0131l\u0131\u011f\u0131yla g\u00fcvenli bir \u015fekilde elde edilen TLSA kayd\u0131n\u0131 kullanarak, kar\u015f\u0131daki sunucunun (web veya e-posta) sundu\u011fu SSL\/TLS sertifikas\u0131n\u0131n do\u011frulu\u011funu teyit etmektir. Geleneksel y\u00f6ntemde taray\u0131c\u0131, sertifikan\u0131n yaln\u0131zca g\u00fcvendi\u011fi bir CA taraf\u0131ndan imzalan\u0131p imzalanmad\u0131\u011f\u0131na bakarken, DANE ile ek ve \u00e7ok daha spesifik bir kontrol yapar. TLSA kayd\u0131nda belirtilen kurallara g\u00f6re (\u00f6rne\u011fin, &#8220;Bu sunucunun sertifikas\u0131 tam olarak bu olmal\u0131&#8221; veya &#8220;Bu sunucunun sertifikas\u0131 yaln\u0131zca \u015fu CA taraf\u0131ndan imzalanmal\u0131&#8221;) sunucunun sertifikas\u0131n\u0131 kontrol eder. Bu, CA sistemine y\u00f6nelik sald\u0131r\u0131lara, yanl\u0131\u015fl\u0131kla veya k\u00f6t\u00fc niyetle d\u00fczenlenmi\u015f sertifikalara kar\u015f\u0131 ek bir koruma katman\u0131 sa\u011flar.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Pratikte-Bir-Web-Sitesi-Baglanti-Senaryosu-Tarayici-ve-Sunucu-Etkilesimi\"><\/span>Pratikte Bir Web Sitesi Ba\u011flant\u0131 Senaryosu: Taray\u0131c\u0131 ve Sunucu Etkile\u015fimi<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>DNSSEC ve DANE&#8217;in birlikte \u00e7al\u0131\u015ft\u0131\u011f\u0131 bir web sitesi ba\u011flant\u0131 senaryosunu ad\u0131m ad\u0131m inceleyelim:<\/p>\n<ol>\n<li><b>Kullan\u0131c\u0131 Adresi Girer:<\/b> Kullan\u0131c\u0131, DANE ve DNSSEC destekli bir taray\u0131c\u0131ya `https:\/\/www.guvenlisite.com` adresini yazar.<\/li>\n<li><b>DNSSEC Do\u011frulamal\u0131 Sorgu:<\/b> Taray\u0131c\u0131n\u0131n arkas\u0131ndaki DNS \u00e7\u00f6z\u00fcmleyici, `www.guvenlisite.com` i\u00e7in hem A (IP adresi) kayd\u0131n\u0131 hem de TLSA kayd\u0131n\u0131 sorgular. Bu sorgu ve al\u0131nan yan\u0131tlar, k\u00f6k sunucudan ba\u015flayarak DNSSEC g\u00fcven zinciri kullan\u0131larak tamamen do\u011frulan\u0131r. \u00c7\u00f6z\u00fcmleyici, hem IP adresinin hem de TLSA kayd\u0131n\u0131n me\u015fru oldu\u011fundan emin olur.<\/li>\n<li><b>TLS El S\u0131k\u0131\u015fmas\u0131 (Handshake) Ba\u015flar:<\/b> Taray\u0131c\u0131, DNSSEC ile do\u011frulanm\u0131\u015f IP adresini kullanarak `www.guvenlisite.com` <a href=\"https:\/\/www.ihs.com.tr\/sunucu-kiralama\/\" target=\"_blank\">sunucu<\/a>suna bir ba\u011flant\u0131 iste\u011fi g\u00f6nderir. Sunucu, TLS el s\u0131k\u0131\u015fmas\u0131n\u0131 ba\u015flatmak i\u00e7in kendi SSL sertifikas\u0131n\u0131 taray\u0131c\u0131ya sunar.<\/li>\n<li><b>DANE Do\u011frulamas\u0131:<\/b> Bu noktada taray\u0131c\u0131 iki kontrol yapar:\n<ul>\n<li><b>Geleneksel CA Kontrol\u00fc:<\/b> Sunucudan gelen sertifikan\u0131n, taray\u0131c\u0131n\u0131n g\u00fcvendi\u011fi bir CA taraf\u0131ndan imzalan\u0131p imzalanmad\u0131\u011f\u0131n\u0131 kontrol eder.<\/li>\n<li><b>DANE Kontrol\u00fc:<\/b> 2. ad\u0131mda DNSSEC ile g\u00fcvenli bir \u015fekilde ald\u0131\u011f\u0131 TLSA kayd\u0131ndaki kurallarla, sunucudan gelen sertifikay\u0131 kar\u015f\u0131la\u015ft\u0131r\u0131r. \u00d6rne\u011fin, TLSA kayd\u0131 &#8220;sertifikan\u0131n SHA-256 \u00f6zeti bu olmal\u0131&#8221; diyorsa, taray\u0131c\u0131 sunucunun sertifikas\u0131n\u0131n \u00f6zetini hesaplar ve e\u015fle\u015fip e\u015fle\u015fmedi\u011fini kontrol eder.<\/li>\n<\/ul>\n<\/li>\n<li><b>G\u00fcvenli Ba\u011flant\u0131:<\/b> Her iki do\u011frulama ad\u0131m\u0131 da (veya TLSA kayd\u0131n\u0131n t\u00fcr\u00fcne g\u00f6re sadece DANE do\u011frulamas\u0131) ba\u015far\u0131l\u0131 olursa, taray\u0131c\u0131 ba\u011flant\u0131n\u0131n g\u00fcvenli oldu\u011funa karar verir ve ye\u015fil kilit simgesini g\u00f6sterir. Aksi takdirde, bir g\u00fcvenlik uyar\u0131s\u0131 g\u00f6stererek kullan\u0131c\u0131y\u0131 olas\u0131 bir Ortadaki Adam sald\u0131r\u0131s\u0131na kar\u015f\u0131 korur.<\/li>\n<\/ol>\n<h3><span class=\"ez-toc-section\" id=\"E-posta-Guvenliginde-DNSSEC-ve-DANE-Kullanimi-SMTP-uzerinden-TLS\"><\/span>E-posta G\u00fcvenli\u011finde DNSSEC ve DANE Kullan\u0131m\u0131 (SMTP \u00fczerinden TLS)<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>DNSSEC ve DANE&#8217;in faydalar\u0131 sadece web siteleriyle s\u0131n\u0131rl\u0131 de\u011fildir; e-posta g\u00fcvenli\u011fi i\u00e7in de kritik \u00f6neme sahiptir. E-posta sunucular\u0131 (MTA &#8211; Mail Transfer Agent) birbirleriyle SMTP protokol\u00fc \u00fczerinden ileti\u015fim kurar. STARTTLS komutu ile bu ileti\u015fim \u015fifreli hale getirilebilir. Ancak geleneksel STARTTLS, bir sunucunun sundu\u011fu sertifikan\u0131n do\u011frulu\u011funu garanti etmez. Bu da MitM sald\u0131r\u0131lar\u0131na ve e-postalar\u0131n gizlice okunmas\u0131na veya de\u011fi\u015ftirilmesine olanak tan\u0131r. DANE, bu sorunu \u00e7\u00f6zer. Bir g\u00f6nderici e-posta sunucusu, al\u0131c\u0131n\u0131n alan ad\u0131 i\u00e7in DANE (TLSA) kayd\u0131n\u0131 sorgular. E\u011fer bir TLSA kayd\u0131 varsa, al\u0131c\u0131 sunucuya ba\u011flan\u0131rken sundu\u011fu sertifikan\u0131n bu kayda uymas\u0131n\u0131 zorunlu k\u0131lar. Bu, iki e-posta sunucusu aras\u0131ndaki ileti\u015fimin sadece \u015fifreli olmas\u0131n\u0131 de\u011fil, ayn\u0131 zamanda do\u011fru sunucuyla yap\u0131ld\u0131\u011f\u0131n\u0131 da garanti ederek e-posta sahtecili\u011fi ve takibine kar\u015f\u0131 \u00e7ok g\u00fc\u00e7l\u00fc bir kalkan olu\u015fturur. Bu mekanizma, <a href=\"https:\/\/www.ihs.com.tr\/blog\/e-posta-iletimini-iyilestiren-dns-kayitlari-spf-dkim-ve-dmarc-detayli-rehber\/\" target=\"_blank\">SPF, DKIM ve DMARC gibi e-posta do\u011frulama<\/a> standartlar\u0131n\u0131 tamamlay\u0131c\u0131 niteliktedir.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"DNSSEC-ve-DANE-Uygulamasi-ve-Yapilandirmasi\"><\/span>DNSSEC ve DANE Uygulamas\u0131 ve Yap\u0131land\u0131rmas\u0131<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>DNSSEC ve DANE&#8217;i hayata ge\u00e7irmek, geleneksel DNS ve SSL yap\u0131land\u0131rmas\u0131ndan daha fazla ad\u0131m gerektiren teknik bir s\u00fcre\u00e7tir. Ancak do\u011fru ara\u00e7lar ve ad\u0131mlar takip edildi\u011finde, bu g\u00fc\u00e7l\u00fc g\u00fcvenlik katmanlar\u0131n\u0131 kendi alan ad\u0131n\u0131za ve sunucular\u0131n\u0131za eklemek m\u00fcmk\u00fcnd\u00fcr. S\u00fcre\u00e7, alan ad\u0131 sa\u011flay\u0131c\u0131s\u0131 (registrar), DNS sunucusu ve web\/mail sunucusu aras\u0131nda koordinasyon gerektirir.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"DNSSEC-ve-DANE-icin-On-Gereksinimler\"><\/span>DNSSEC ve DANE i\u00e7in \u00d6n Gereksinimler<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Uygulamaya ba\u015flamadan \u00f6nce, altyap\u0131n\u0131z\u0131n bu teknolojileri destekledi\u011finden emin olman\u0131z gerekir. Temel gereksinimler \u015funlard\u0131r:<\/p>\n<ul>\n<li><b>Destekleyen Alan Ad\u0131 Sa\u011flay\u0131c\u0131s\u0131 (Registrar):<\/b> Alan ad\u0131n\u0131z\u0131 kaydettirdi\u011finiz \u015firketin, DNSSEC&#8217;i desteklemesi ve panel \u00fczerinden DS (Delegation Signer) kay\u0131tlar\u0131n\u0131 \u00fcst d\u00fczey alan ad\u0131 (TLD) sunucular\u0131na iletmenize olanak tan\u0131mas\u0131 gerekir.<\/li>\n<li><b>Destekleyen DNS Sunucusu\/Servisi:<\/b> Kulland\u0131\u011f\u0131n\u0131z DNS <a href=\"https:\/\/www.ihs.com.tr\/web-hosting\/\" target=\"_blank\">hosting<\/a> hizmetinin, DNSSEC anahtarlar\u0131 olu\u015fturman\u0131za, b\u00f6lge (zone) imzalaman\u0131za ve TLSA gibi \u00f6zel kay\u0131t t\u00fcrlerini eklemenize izin vermesi \u015fartt\u0131r.<\/li>\n<li><b>Sunucu Eri\u015fimi ve Bilgisi:<\/b> DNSSEC anahtarlar\u0131n\u0131 olu\u015fturmak ve TLSA kayd\u0131n\u0131 yap\u0131land\u0131rmak i\u00e7in genellikle sunucunuza komut sat\u0131r\u0131 (SSH) \u00fczerinden eri\u015fiminiz olmas\u0131 ve temel Linux\/sunucu y\u00f6netimi bilgisine sahip olman\u0131z beklenir.<\/li>\n<li><b>Mevcut bir SSL\/TLS Sertifikas\u0131:<\/b> DANE&#8217;i (TLSA kayd\u0131n\u0131) yap\u0131land\u0131rmak i\u00e7in, ili\u015fkilendirece\u011finiz bir SSL sertifikas\u0131na sahip olman\u0131z gerekir. Bu, bir CA&#8217;dan al\u0131nm\u0131\u015f veya kendi kendine imzalanm\u0131\u015f (self-signed) bir sertifika olabilir.<\/li>\n<\/ul>\n<h3><span class=\"ez-toc-section\" id=\"Alan-Adi-Saglayicisi-Registrar-Tarafinda-DNSSEC-Aktivasyonu\"><\/span>Alan Ad\u0131 Sa\u011flay\u0131c\u0131s\u0131 (Registrar) Taraf\u0131nda DNSSEC Aktivasyonu<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>DNSSEC g\u00fcven zincirini ba\u015flatman\u0131n ilk ad\u0131m\u0131, alan ad\u0131 sa\u011flay\u0131c\u0131n\u0131z\u0131n paneli \u00fczerinden ger\u00e7ekle\u015fir. DNS sunucunuzda DNSSEC anahtarlar\u0131n\u0131z\u0131 olu\u015fturduktan sonra, bu anahtarlardan t\u00fcretilen bir DS kayd\u0131 elde edersiniz. Bu DS kayd\u0131, sizin alan ad\u0131n\u0131z\u0131n a\u00e7\u0131k anahtar\u0131n\u0131n bir &#8220;parmak izi&#8221; gibidir ve \u00fcst b\u00f6lgeye (\u00f6rne\u011fin `.com.tr` veya `.com`) sizin kimli\u011finizi do\u011frulamas\u0131 i\u00e7in verilir. S\u00fcre\u00e7 genel olarak \u015f\u00f6yledir:<\/p>\n<ol>\n<li>DNS sunucunuzda DNSSEC anahtarlar\u0131n\u0131 (KSK ve ZSK) olu\u015fturun.<\/li>\n<li>Bu anahtarlardan DS kayd\u0131 verilerini (Anahtar Etiketi, Algoritma, \u00d6zet T\u00fcr\u00fc ve \u00d6zet) al\u0131n.<\/li>\n<li>Alan ad\u0131 sa\u011flay\u0131c\u0131n\u0131z\u0131n kontrol paneline giri\u015f yap\u0131n.<\/li>\n<li>\u0130lgili alan ad\u0131n\u0131n DNS y\u00f6netimi veya DNSSEC b\u00f6l\u00fcm\u00fcne gidin.<\/li>\n<li>DS kayd\u0131 ekleme se\u00e7ene\u011fini bulun ve 2. ad\u0131mda elde etti\u011finiz bilgileri ilgili alanlara girerek kaydedin. Bu i\u015flem, g\u00fcven zincirini sizin alan ad\u0131n\u0131zdan \u00fcst TLD&#8217;ye ba\u011flar.<\/li>\n<\/ol>\n<h3><span class=\"ez-toc-section\" id=\"Sunucu-Tarafinda-DNSSEC-Anahtarlarinin-Olusturulmasi-ve-Yonetimi\"><\/span>Sunucu Taraf\u0131nda DNSSEC Anahtarlar\u0131n\u0131n Olu\u015fturulmas\u0131 ve Y\u00f6netimi<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>DNSSEC&#8217;in kalbi, sunucunuzda olu\u015fturulan ve y\u00f6netilen kriptografik anahtarlard\u0131r. Bu i\u015flem genellikle BIND gibi DNS sunucu yaz\u0131l\u0131mlar\u0131yla birlikte gelen `dnssec-keygen` ve `dnssec-signzone` gibi ara\u00e7larla yap\u0131l\u0131r. \u0130ki t\u00fcr anahtar olu\u015fturulur:<\/p>\n<ul>\n<li><b>B\u00f6lge \u0130mzalama Anahtar\u0131 (Zone Signing Key &#8211; ZSK):<\/b> DNS b\u00f6lgenizdeki t\u00fcm kay\u0131tlar\u0131 (A, MX, TXT vb.) imzalamak i\u00e7in kullan\u0131l\u0131r. G\u00fcvenlik nedeniyle genellikle s\u0131k s\u0131k (\u00f6rne\u011fin ayda bir) de\u011fi\u015ftirilir.<\/li>\n<li><b>Anahtar \u0130mzalama Anahtar\u0131 (Key Signing Key &#8211; KSK):<\/b> Sadece ZSK&#8217;n\u0131n kendisini imzalamak i\u00e7in kullan\u0131l\u0131r. DS kayd\u0131 bu anahtardan t\u00fcretildi\u011fi i\u00e7in daha az s\u0131kl\u0131kla (\u00f6rne\u011fin y\u0131lda bir) de\u011fi\u015ftirilir. KSK de\u011fi\u015ftirildi\u011finde, registrar taraf\u0131nda yeni DS kayd\u0131n\u0131n g\u00fcncellenmesi gerekir.<\/li>\n<\/ul>\n<p>Anahtar olu\u015fturma, b\u00f6lgeyi imzalama ve anahtarlar\u0131 d\u00fczenli olarak yenileme (key rollover) s\u00fcre\u00e7leri dikkatli bir y\u00f6netim gerektirir. Hatal\u0131 bir i\u015flem, alan ad\u0131n\u0131z\u0131n do\u011frulanamamas\u0131na ve eri\u015filemez hale gelmesine neden olabilir.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"TLSA-Kaydi-Olusturma-ve-DNSe-Ekleme-Araclari\"><\/span>TLSA Kayd\u0131 Olu\u015fturma ve DNS&#8217;e Ekleme Ara\u00e7lar\u0131<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>DNSSEC&#8217;i ba\u015far\u0131yla etkinle\u015ftirdikten sonra, DANE&#8217;i uygulamak i\u00e7in TLSA kayd\u0131 olu\u015fturman\u0131z gerekir. Bu kay\u0131t, `_port._protocol.hostname` format\u0131nda \u00f6zel bir isimle olu\u015fturulur. \u00d6rne\u011fin, `www.ihs.com.tr` adresindeki web sunucusu i\u00e7in kay\u0131t `_443._tcp.www.ihs.com.tr` \u015feklinde olur. TLSA kayd\u0131n\u0131n veri b\u00f6l\u00fcm\u00fcn\u00fc (Sertifika Kullan\u0131m\u0131, Se\u00e7ici, E\u015fle\u015fme T\u00fcr\u00fc ve Sertifika Verisi) manuel olarak olu\u015fturmak karma\u015f\u0131k olabilir. Neyse ki bu i\u015flemi kolayla\u015ft\u0131ran \u00e7e\u015fitli ara\u00e7lar mevcuttur:<\/p>\n<ul>\n<li><b>Online Jenerat\u00f6rler:<\/b> Shadoff&#8217;s TLSA Generator gibi web siteleri, SSL sertifikan\u0131z\u0131 (veya sadece alan ad\u0131n\u0131z\u0131) girerek size haz\u0131r TLSA kayd\u0131n\u0131 olu\u015fturur.<\/li>\n<li><b>Komut Sat\u0131r\u0131 Ara\u00e7lar\u0131:<\/b> `openssl` komutlar\u0131 veya `hash-slinger` gibi \u00f6zel ara\u00e7lar kullanarak sunucunuzdaki sertifikadan do\u011frudan TLSA kayd\u0131 verisini \u00fcretebilirsiniz.<\/li>\n<\/ul>\n<p>Olu\u015fturulan TLSA kayd\u0131n\u0131, standart bir TXT veya A kayd\u0131 ekler gibi DNS y\u00f6netim panelinizden DNS b\u00f6lgenize eklemeniz yeterlidir.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Yapilandirma-Sonrasi-Dogrulama-ve-Test-Yontemleri\"><\/span>Yap\u0131land\u0131rma Sonras\u0131 Do\u011frulama ve Test Y\u00f6ntemleri<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>DNSSEC ve DANE yap\u0131land\u0131rmas\u0131n\u0131 tamamlad\u0131ktan sonra her \u015feyin do\u011fru \u00e7al\u0131\u015ft\u0131\u011f\u0131ndan emin olmak kritik \u00f6neme sahiptir. Yanl\u0131\u015f bir yap\u0131land\u0131rma, sitenize veya e-posta hizmetinize eri\u015fimi engelleyebilir. Do\u011frulama i\u00e7in kullanabilece\u011finiz baz\u0131 pop\u00fcler \u00e7evrimi\u00e7i ara\u00e7lar \u015funlard\u0131r:<\/p>\n<ul>\n<li><b>DNSViz (dnsviz.net):<\/b> Alan ad\u0131n\u0131z\u0131n DNSSEC g\u00fcven zincirini k\u00f6k sunucudan ba\u015flayarak g\u00f6rsel olarak analiz eder. Hatalar\u0131 ve eksik ad\u0131mlar\u0131 tespit etmek i\u00e7in m\u00fckemmel bir ara\u00e7t\u0131r.<\/li>\n<li><b>Verisign DNSSEC Debugger:<\/b> DNSSEC yap\u0131land\u0131rman\u0131z\u0131n ad\u0131m ad\u0131m analizini sunar ve olas\u0131 sorunlar hakk\u0131nda detayl\u0131 bilgi verir.<\/li>\n<li><b>DANE validators (\u00f6rne\u011fin, dane.sys4.de):<\/b> Web siteniz veya e-posta sunucunuz i\u00e7in DANE (TLSA) kayd\u0131n\u0131n do\u011fru yap\u0131land\u0131r\u0131l\u0131p yap\u0131land\u0131r\u0131lmad\u0131\u011f\u0131n\u0131 ve sunucunuzun sundu\u011fu sertifika ile e\u015fle\u015fip e\u015fle\u015fmedi\u011fini kontrol eder.<\/li>\n<\/ul>\n<p>Bu ara\u00e7lar\u0131 kullanarak yap\u0131land\u0131rman\u0131z\u0131 test etmek, olas\u0131 sorunlar\u0131 kullan\u0131c\u0131lar\u0131n\u0131z etkilenmeden \u00f6nce tespit edip \u00e7\u00f6zmenize olanak tan\u0131r.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"DNSSEC-ve-DANEin-Isletmeler-ve-Son-Kullanicilar-Icin-Pratik-Faydalari\"><\/span>DNSSEC ve DANE&#8217;in \u0130\u015fletmeler ve Son Kullan\u0131c\u0131lar \u0130\u00e7in Pratik Faydalar\u0131<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>DNSSEC ve DANE&#8217;in uygulanmas\u0131, ilk bak\u0131\u015fta karma\u015f\u0131k bir teknik s\u00fcre\u00e7 gibi g\u00f6r\u00fcnse de, sa\u011flad\u0131\u011f\u0131 somut g\u00fcvenlik avantajlar\u0131 bu \u00e7abaya fazlas\u0131yla de\u011fmektedir. Bu teknolojiler, hem i\u015fletmelerin dijital varl\u0131klar\u0131n\u0131 ve itibarlar\u0131n\u0131 korumalar\u0131na hem de son kullan\u0131c\u0131lar\u0131n daha g\u00fcvenli bir internet deneyimi ya\u015famalar\u0131na do\u011frudan katk\u0131da bulunur. Gelin bu pratik faydalar\u0131 daha yak\u0131ndan inceleyelim.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Phishing-ve-Ortadaki-Adam-Saldirilarina-Karsi-Gelismis-Koruma\"><\/span>Phishing ve Ortadaki Adam Sald\u0131r\u0131lar\u0131na Kar\u015f\u0131 Geli\u015fmi\u015f Koruma<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Son kullan\u0131c\u0131lar i\u00e7in en belirgin fayda, en tehlikeli siber sald\u0131r\u0131 t\u00fcrlerinden ikisine kar\u015f\u0131 g\u00fc\u00e7l\u00fc bir kalkan olu\u015fturulmas\u0131d\u0131r. DNSSEC, kullan\u0131c\u0131lar\u0131n banka, e-ticaret veya sosyal medya sitelerine eri\u015fmeye \u00e7al\u0131\u015f\u0131rken DNS sahtekarl\u0131\u011f\u0131 yoluyla sahte, kimlik av\u0131 (phishing) sitelerine y\u00f6nlendirilmesini engeller. DANE ise bu korumay\u0131 bir ad\u0131m \u00f6teye ta\u015f\u0131yarak, do\u011fru siteye ula\u015fsan\u0131z bile aradaki ba\u011flant\u0131n\u0131n bir sald\u0131rgan taraf\u0131ndan dinlenmedi\u011fini, sahte bir sertifika kullan\u0131lmad\u0131\u011f\u0131n\u0131 garanti eder. Bu sayede kullan\u0131c\u0131lar\u0131n parolalar\u0131, finansal bilgileri ve ki\u015fisel verileri \u00e7ok daha g\u00fcvende olur.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Marka-Itibari-ve-Musteri-Guveninin-Artirilmasi\"><\/span>Marka \u0130tibar\u0131 ve M\u00fc\u015fteri G\u00fcveninin Art\u0131r\u0131lmas\u0131<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>\u0130\u015fletmeler i\u00e7in marka itibar\u0131, en de\u011ferli varl\u0131klardan biridir. DNSSEC ve DANE&#8217;i benimseyen bir \u015firket, m\u00fc\u015fterilerine ve i\u015f ortaklar\u0131na g\u00fcvenlik konusunu ciddiye ald\u0131\u011f\u0131n\u0131 ve onlar\u0131n verilerini korumak i\u00e7in en son teknolojileri kulland\u0131\u011f\u0131n\u0131 g\u00f6stermi\u015f olur. M\u00fc\u015fteriler, bir web sitesinin veya e-posta hizmetinin bu t\u00fcr geli\u015fmi\u015f g\u00fcvenlik \u00f6nlemlerine sahip oldu\u011funu bildi\u011finde, o markaya olan g\u00fcvenleri artar. Bu g\u00fcven, daha y\u00fcksek d\u00f6n\u00fc\u015f\u00fcm oranlar\u0131, artan m\u00fc\u015fteri sadakati ve olumlu bir kamu imaj\u0131 olarak i\u015fletmeye geri d\u00f6ner. \u00d6zellikle e-ticaret, bankac\u0131l\u0131k ve sa\u011fl\u0131k gibi hassas verilerin i\u015flendi\u011fi sekt\u00f6rlerde bu g\u00fcven fakt\u00f6r\u00fc rekabette \u00f6nemli bir avantaj sa\u011flar.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Sertifika-Otoritesi-Kaynakli-Guvenlik-Risklerinin-ve-Maliyetlerinin-Azaltilmasi\"><\/span>Sertifika Otoritesi Kaynakl\u0131 G\u00fcvenlik Risklerinin ve Maliyetlerinin Azalt\u0131lmas\u0131<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Geleneksel SSL modeli, tamamen Sertifika Otoritelerine (CA) olan g\u00fcvene dayan\u0131r. Ancak ge\u00e7mi\u015fte ya\u015fanan CA s\u0131z\u0131nt\u0131lar\u0131, bu modelin zay\u0131f bir halka olabilece\u011fini g\u00f6stermi\u015ftir. DANE, i\u015fletmelere bu ba\u011f\u0131ml\u0131l\u0131\u011f\u0131 y\u00f6netme ve azaltma imkan\u0131 sunar. \u00d6rne\u011fin, bir i\u015fletme DANE&#8217;in `DANE-EE` modunu kullanarak, harici bir CA&#8217;ya ihtiya\u00e7 duymadan kendi kendine imzalad\u0131\u011f\u0131 (self-signed) sertifikalar\u0131 g\u00fcvenli bir \u015fekilde kullanabilir. Bu, y\u0131ll\u0131k <a href=\"https:\/\/www.ihs.com.tr\/blog\/lets-encrypt-ve-ucretli-ssl-sertifikalari-arasindaki-farklar\/\" target=\"_blank\">SSL sertifikas\u0131 maliyetlerini ortadan kald\u0131r\u0131r<\/a>. Alternatif olarak, `PKIX-TA` veya `PKIX-EE` modlar\u0131 ile yaln\u0131zca belirli, g\u00fcvendikleri bir CA taraf\u0131ndan verilen sertifikalar\u0131n ge\u00e7erli olmas\u0131n\u0131 zorunlu k\u0131larak di\u011fer y\u00fczlerce CA&#8217;dan kaynaklanabilecek potansiyel riskleri bertaraf edebilirler. Bu, g\u00fcvenlik duru\u015fu \u00fczerinde daha fazla kontrol ve potansiyel maliyet tasarrufu anlam\u0131na gelir.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"E-posta-Iletisiminde-Sahtecilige-ve-Takibe-Karsi-Guvenligin-Saglanmasi\"><\/span>E-posta \u0130leti\u015fiminde Sahtecili\u011fe ve Takibe Kar\u015f\u0131 G\u00fcvenli\u011fin Sa\u011flanmas\u0131<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>\u0130\u015fletmeler aras\u0131 (B2B) ileti\u015fim b\u00fcy\u00fck \u00f6l\u00e7\u00fcde e-posta \u00fczerinden y\u00fcr\u00fcr. Standart e-posta ileti\u015fimi, gizli dinlemeye ve sahtecili\u011fe (spoofing) kar\u015f\u0131 savunmas\u0131zd\u0131r. Bir sald\u0131rgan, iki \u015firket aras\u0131ndaki e-posta trafi\u011fini gizlice izleyerek fatura bilgilerini de\u011fi\u015ftirebilir veya hassas ticari s\u0131rlar\u0131 \u00e7alabilir. DNSSEC ve DANE (SMTP \u00fczerinden TLS i\u00e7in), sunucular aras\u0131 e-posta ileti\u015fimini zorunlu olarak \u015fifreler ve kimlik do\u011frulamas\u0131 yapar. Bu sayede bir \u015firketten g\u00f6nderilen e-postan\u0131n, al\u0131c\u0131 sunucuya ula\u015fana kadar de\u011fi\u015ftirilmedi\u011fi ve do\u011fru sunucuya teslim edildi\u011fi garanti alt\u0131na al\u0131n\u0131r. Bu, kurumsal casuslu\u011fa, fatura sahtekarl\u0131\u011f\u0131na ve di\u011fer e-posta tabanl\u0131 sald\u0131r\u0131lara kar\u015f\u0131 kritik bir savunma hatt\u0131 olu\u015fturur.<\/p>\n<h2><span class=\"ez-toc-section\" id=\"DNSSEC-DANE-ve-Alan-Adi-Guvenligi-Icin-Neden-IHS-Telekomu-Tercih-Etmelisiniz\"><\/span>DNSSEC, DANE ve Alan Ad\u0131 G\u00fcvenli\u011fi \u0130\u00e7in Neden \u0130HS Telekom&#8217;u Tercih Etmelisiniz?<span class=\"ez-toc-section-end\"><\/span><\/h2>\n<p>Alan ad\u0131 g\u00fcvenli\u011fi, dijital varl\u0131\u011f\u0131n\u0131z\u0131n temelini olu\u015fturur. DNSSEC ve DANE gibi ileri d\u00fczey g\u00fcvenlik protokollerini uygulamak, teknik bilgi ve g\u00fcvenilir bir altyap\u0131 gerektirir. \u0130HS Telekom olarak, alan ad\u0131n\u0131z\u0131n ve dolay\u0131s\u0131yla markan\u0131z\u0131n g\u00fcvenli\u011fini en \u00fcst d\u00fczeye \u00e7\u0131karmak i\u00e7in tasarlanm\u0131\u015f kapsaml\u0131, kullan\u0131c\u0131 dostu ve uzman destekli \u00e7\u00f6z\u00fcmler sunuyoruz. G\u00fcvenli\u011finizi \u015fansa b\u0131rakmaman\u0131z i\u00e7in yan\u0131n\u0131zday\u0131z.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Tek-Tikla-Kolay-DNSSEC-Aktivasyonu-ve-Yonetimi\"><\/span>Tek T\u0131kla Kolay DNSSEC Aktivasyonu ve Y\u00f6netimi<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>DNSSEC yap\u0131land\u0131rmas\u0131n\u0131n karma\u015f\u0131kl\u0131\u011f\u0131, bir\u00e7ok kullan\u0131c\u0131 i\u00e7in cayd\u0131r\u0131c\u0131 olabilir. \u0130HS Telekom, bu s\u00fcreci sizin i\u00e7in basitle\u015ftirir. Geli\u015fmi\u015f kontrol panelimiz sayesinde, karma\u015f\u0131k komut sat\u0131r\u0131 i\u015flemleriyle veya anahtar y\u00f6netimiyle u\u011fra\u015fman\u0131za gerek kalmadan, alan adlar\u0131n\u0131z i\u00e7in DNSSEC&#8217;i tek bir t\u0131klama ile etkinle\u015ftirebilirsiniz. Sistemimiz, gerekli anahtarlar\u0131 otomatik olarak olu\u015fturur, DNS b\u00f6lgenizi imzalar ve DS kay\u0131tlar\u0131n\u0131 \u00fcst d\u00fczey otoritelere g\u00fcvenli bir \u015fekilde iletir. Size sadece g\u00fcvenli\u011fin keyfini \u00e7\u0131karmak kal\u0131r.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Uzman-Teknik-Destek-ve-Danismanlik-Hizmetleri\"><\/span>Uzman Teknik Destek ve Dan\u0131\u015fmanl\u0131k Hizmetleri<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>DNSSEC ve DANE gibi konularda sorular\u0131n\u0131z veya yard\u0131ma ihtiyac\u0131n\u0131z olabilir. \u0130HS Telekom&#8217;un alan\u0131nda uzman teknik destek ekibi, s\u00fcrecin her a\u015famas\u0131nda size yard\u0131mc\u0131 olmaya haz\u0131rd\u0131r. \u0130ster ilk kurulumda, ister TLSA kayd\u0131 olu\u015fturmada, isterseniz de yap\u0131land\u0131rma sonras\u0131 do\u011frulama a\u015famas\u0131nda olsun, deneyimli ekibimiz size en do\u011fru bilgiyi ve pratik \u00e7\u00f6z\u00fcmleri sunar. G\u00fcvenlik altyap\u0131n\u0131z\u0131 kurarken yaln\u0131z olmad\u0131\u011f\u0131n\u0131z\u0131 bilirsiniz.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Guvenilir-Hizli-ve-Yuksek-Performansli-DNS-Altyapisi\"><\/span>G\u00fcvenilir, H\u0131zl\u0131 ve Y\u00fcksek Performansl\u0131 DNS Altyap\u0131s\u0131<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>Bir g\u00fcvenlik protokol\u00fc, \u00fczerinde \u00e7al\u0131\u015ft\u0131\u011f\u0131 altyap\u0131 kadar g\u00fc\u00e7l\u00fcd\u00fcr. \u0130HS Telekom, co\u011frafi olarak yedekli, y\u00fcksek performansl\u0131 ve DDoS sald\u0131r\u0131lar\u0131na kar\u015f\u0131 g\u00fc\u00e7lendirilmi\u015f bir DNS altyap\u0131s\u0131 sunar. DNSSEC&#8217;in getirebilece\u011fi ek sorgu y\u00fck\u00fcn\u00fc rahatl\u0131kla kar\u015f\u0131layacak \u015fekilde optimize edilmi\u015f sunucular\u0131m\u0131z, alan ad\u0131n\u0131z\u0131n hem g\u00fcvenli hem de her zaman h\u0131zl\u0131 ve eri\u015filebilir olmas\u0131n\u0131 sa\u011flar. G\u00fcvenilirli\u011fimiz, sizin kesintisiz hizmet vermenizin teminat\u0131d\u0131r.<\/p>\n<h3><span class=\"ez-toc-section\" id=\"Alan-Adi-Guvenliginiz-Icin-Uctan-Uca-Entegre-Cozumler\"><\/span>Alan Ad\u0131 G\u00fcvenli\u011finiz \u0130\u00e7in U\u00e7tan Uca Entegre \u00c7\u00f6z\u00fcmler<span class=\"ez-toc-section-end\"><\/span><\/h3>\n<p>\u0130HS Telekom, sadece DNSSEC aktivasyonu sunmakla kalmaz, <a href=\"https:\/\/www.ihs.com.tr\/domain-guvenligi-nasil-saglanir\/\" target=\"_blank\">alan ad\u0131 g\u00fcvenli\u011finiz<\/a> i\u00e7in b\u00fct\u00fcnc\u00fcl bir yakla\u015f\u0131m benimser. Alan ad\u0131 tescilinden ve transfer kilidinden, en geli\u015fmi\u015f SSL sertifikalar\u0131na; g\u00fcvenilir <a href=\"https:\/\/www.ihs.com.tr\/web-hosting\/wordpress-hosting.html\" target=\"_blank\">wordpress hosting<\/a> hizmetlerinden, y\u00fcksek performansl\u0131 sanal sunuculara (<a href=\"https:\/\/www.ihs.com.tr\/sunucu-kiralama\/vps-server.html\" target=\"_blank\">VPS<\/a>, <a href=\"https:\/\/www.ihs.com.tr\/sunucu-kiralama\/vds-sunucu.html\" target=\"_blank\">VDS<\/a>) kadar t\u00fcm ihtiya\u00e7lar\u0131n\u0131z\u0131 tek bir \u00e7at\u0131 alt\u0131nda kar\u015f\u0131l\u0131yoruz. DNSSEC ve DANE&#8217;i bu entegre hizmetler portf\u00f6y\u00fcn\u00fcn bir par\u00e7as\u0131 olarak sunarak, dijital varl\u0131klar\u0131n\u0131z i\u00e7in 360 derecelik bir koruma kalkan\u0131 olu\u015fturman\u0131za yard\u0131mc\u0131 oluyoruz.<\/p>\n","protected":false},"excerpt":{"rendered":"<p>\u0130nternet altyap\u0131s\u0131n\u0131n temel ta\u015flar\u0131 olan DNS (Alan Ad\u0131 Sistemi) ve SSL\/TLS (G\u00fcvenli Soket Katman\u0131\/Ta\u015f\u0131ma Katman\u0131 G\u00fcvenli\u011fi) protokolleri, dijital d\u00fcnyadaki ileti\u015fimimizin g\u00fcvenli\u011fini sa\u011flamak&hellip;<\/p>\n","protected":false},"author":3,"featured_media":16611,"comment_status":"open","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[400],"tags":[],"class_list":["post-16610","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-ssl-sertifikasi"],"amp_enabled":true,"_links":{"self":[{"href":"https:\/\/www.ihs.com.tr\/blog\/wp-json\/wp\/v2\/posts\/16610","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.ihs.com.tr\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.ihs.com.tr\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.ihs.com.tr\/blog\/wp-json\/wp\/v2\/users\/3"}],"replies":[{"embeddable":true,"href":"https:\/\/www.ihs.com.tr\/blog\/wp-json\/wp\/v2\/comments?post=16610"}],"version-history":[{"count":1,"href":"https:\/\/www.ihs.com.tr\/blog\/wp-json\/wp\/v2\/posts\/16610\/revisions"}],"predecessor-version":[{"id":16612,"href":"https:\/\/www.ihs.com.tr\/blog\/wp-json\/wp\/v2\/posts\/16610\/revisions\/16612"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.ihs.com.tr\/blog\/wp-json\/wp\/v2\/media\/16611"}],"wp:attachment":[{"href":"https:\/\/www.ihs.com.tr\/blog\/wp-json\/wp\/v2\/media?parent=16610"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.ihs.com.tr\/blog\/wp-json\/wp\/v2\/categories?post=16610"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.ihs.com.tr\/blog\/wp-json\/wp\/v2\/tags?post=16610"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}