{"id":5052,"date":"2026-08-29T19:33:52","date_gmt":"2026-08-29T16:33:52","guid":{"rendered":"https:\/\/www.dchost.com\/blog\/?p=5052"},"modified":"2026-08-29T19:33:52","modified_gmt":"2026-08-29T16:33:52","slug":"dnssec-nedir-alan-adinizi-nasil-guvenceye-alirsiniz","status":"publish","type":"post","link":"https:\/\/www.dchost.com\/blog\/dnssec-nedir-alan-adinizi-nasil-guvenceye-alirsiniz\/","title":{"rendered":"DNSSEC Nedir? Alan Ad\u0131n\u0131z\u0131 Nas\u0131l G\u00fcvenceye Al\u0131rs\u0131n\u0131z?"},"content":{"rendered":"<div class=\"dchost-blog-content-wrapper\"><div id=\"toc_container\" role=\"navigation\" aria-label=\"Table of Contents\" data-nosnippet class=\"toc_transparent no_bullets toc_numbered toc_title_center\"><p class=\"toc_title\">\u0130\u00e7indekiler<\/p><ul class=\"toc_list\"><li><a href=\"#DNSSEC_alan_adinizin_hangi_cevaba_guvenecegini_belirler\"><span class=\"toc_number toc_depth_1\">1.<\/span> DNSSEC alan ad\u0131n\u0131z\u0131n hangi cevaba g\u00fcvenece\u011fini belirler<\/a><\/li><li><a href=\"#DNS8217in_zayif_noktasi_nerede\"><span class=\"toc_number toc_depth_1\">2.<\/span> DNS&#8217;in zay\u0131f noktas\u0131 nerede?<\/a><\/li><li><a href=\"#Imza_zinciri_hangi_kayitlardan_olusur\"><span class=\"toc_number toc_depth_1\">3.<\/span> \u0130mza zinciri hangi kay\u0131tlardan olu\u015fur?<\/a><ul><li><a href=\"#KSK_ve_ZSK_farki\"><span class=\"toc_number toc_depth_2\">3.1.<\/span> KSK ve ZSK fark\u0131<\/a><\/li><\/ul><\/li><li><a href=\"#DNSSEC_ile_HTTPS_ayni_sey_degildir\"><span class=\"toc_number toc_depth_1\">4.<\/span> DNSSEC ile HTTPS ayn\u0131 \u015fey de\u011fildir<\/a><\/li><li><a href=\"#Etkinlestirmeden_once_DNS_mimarisini_netlestirin\"><span class=\"toc_number toc_depth_1\">5.<\/span> Etkinle\u015ftirmeden \u00f6nce DNS mimarisini netle\u015ftirin<\/a><\/li><li><a href=\"#Panel_uzerinden_DNSSEC_kurulumu\"><span class=\"toc_number toc_depth_1\">6.<\/span> Panel \u00fczerinden DNSSEC kurulumu<\/a><\/li><li><a href=\"#Linux_uzerinden_DNSSEC_dogrulama\"><span class=\"toc_number toc_depth_1\">7.<\/span> Linux \u00fczerinden DNSSEC do\u011frulama<\/a><\/li><li><a href=\"#Etkinlestirdikten_sonra_hangi_testleri_yaparim\"><span class=\"toc_number toc_depth_1\">8.<\/span> Etkinle\u015ftirdikten sonra hangi testleri yapar\u0131m?<\/a><\/li><li><a href=\"#SERVFAIL_gordugunuzde_ilk_bakacaginiz_yerler\"><span class=\"toc_number toc_depth_1\">9.<\/span> SERVFAIL g\u00f6rd\u00fc\u011f\u00fcn\u00fczde ilk bakaca\u011f\u0131n\u0131z yerler<\/a><\/li><li><a href=\"#DNSSEC8217in_sinirlari_ve_bakim_isi\"><span class=\"toc_number toc_depth_1\">10.<\/span> DNSSEC&#8217;in s\u0131n\u0131rlar\u0131 ve bak\u0131m i\u015fi<\/a><\/li><li><a href=\"#Alan_adiniz_icin_uygulanabilir_bir_DNSSEC_plani\"><span class=\"toc_number toc_depth_1\">11.<\/span> Alan ad\u0131n\u0131z i\u00e7in uygulanabilir bir DNSSEC plan\u0131<\/a><\/li><li><a href=\"#Sik_Sorulan_Sorular\"><span class=\"toc_number toc_depth_1\">12.<\/span> S\u0131k Sorulan Sorular<\/a><ul><li><a href=\"#DNSSEC_nedir_her_alan_adi_icin_gerekli_midir\"><span class=\"toc_number toc_depth_2\">12.1.<\/span> DNSSEC nedir, her alan ad\u0131 i\u00e7in gerekli midir?<\/a><\/li><li><a href=\"#DNSSEC_web_sitesini_yavaslatir_mi\"><span class=\"toc_number toc_depth_2\">12.2.<\/span> DNSSEC web sitesini yava\u015flat\u0131r m\u0131?<\/a><\/li><li><a href=\"#DNSSEC_acinca_SSL_sertifikasina_hala_ihtiyac_var_mi\"><span class=\"toc_number toc_depth_2\">12.3.<\/span> DNSSEC a\u00e7\u0131nca SSL sertifikas\u0131na h\u00e2l\u00e2 ihtiya\u00e7 var m\u0131?<\/a><\/li><li><a href=\"#DNSSEC_sonrasi_alan_adim_SERVFAIL_veriyor_ne_yapmaliyim\"><span class=\"toc_number toc_depth_2\">12.4.<\/span> DNSSEC sonras\u0131 alan ad\u0131m SERVFAIL veriyor, ne yapmal\u0131y\u0131m?<\/a><\/li><\/ul><\/li><\/ul><\/div>\n<h2><span id=\"DNSSEC_alan_adinizin_hangi_cevaba_guvenecegini_belirler\">DNSSEC alan ad\u0131n\u0131z\u0131n hangi cevaba g\u00fcvenece\u011fini belirler<\/span><\/h2>\n<p>Evdeki Proxmox lab&#8217;\u0131mda bir test alan\u0131n\u0131n KSK anahtar\u0131n\u0131 d\u00f6nd\u00fcr\u00fcyordum. DS kayd\u0131n\u0131 yeni anahtar haz\u0131r olmadan de\u011fi\u015ftirdim ve birka\u00e7 dakika sonra b\u00fct\u00fcn sorgular <code>SERVFAIL<\/code> vermeye ba\u015flad\u0131. \u00dcretim alan ad\u0131 de\u011fildi; yine de DNSSEC&#8217;in k\u00fc\u00e7\u00fck bir zamanlama hatas\u0131n\u0131 nas\u0131l g\u00f6r\u00fcn\u00fcr bir kesintiye \u00e7evirdi\u011fini o g\u00fcn tekrar g\u00f6rd\u00fcm.<\/p>\n<p>DNSSEC&#8217;in temel g\u00f6revi, DNS cevab\u0131n\u0131n ger\u00e7ekten yetkili kaynaktan gelip gelmedi\u011fini ve aktar\u0131m s\u0131ras\u0131nda de\u011fi\u015ftirilip de\u011fi\u015ftirilmedi\u011fini do\u011frulamakt\u0131r. DNSSEC DNS trafi\u011fini \u015fifrelemez. Parolalar\u0131n\u0131z\u0131 ya da web sayfan\u0131z\u0131n i\u00e7eri\u011fini gizlemez. DNS kay\u0131tlar\u0131na dijital imza ekler ve do\u011frulama yapan resolver&#8217;\u0131n cevaba g\u00fcvenip g\u00fcvenmeyece\u011fini belirlemesine yard\u0131m eder.<\/p>\n<p>&#8220;DNSSEC nedir?&#8221; sorusuna k\u0131sa cevab\u0131m \u015fu: DNSSEC, alan ad\u0131n\u0131z\u0131n DNS kay\u0131tlar\u0131n\u0131n sahte cevaplarla de\u011fi\u015ftirilmesini zorla\u015ft\u0131ran ve DNS hiyerar\u015fisi boyunca \u00e7al\u0131\u015fan bir do\u011frulama mekanizmas\u0131d\u0131r. A, AAAA, MX veya TXT kayd\u0131n\u0131 isteyen do\u011frulay\u0131c\u0131 bir DNS \u00e7\u00f6z\u00fcmleyici, ald\u0131\u011f\u0131 cevab\u0131n imzas\u0131n\u0131 ve g\u00fcven zincirini kontrol eder.<\/p>\n<h2><span id=\"DNS8217in_zayif_noktasi_nerede\">DNS&#8217;in zay\u0131f noktas\u0131 nerede?<\/span><\/h2>\n<p>DNS, alan ad\u0131n\u0131 IP adresine \u00e7evirir. Taray\u0131c\u0131 <code>example.com<\/code> i\u00e7in A veya AAAA kayd\u0131 sordu\u011funda, \u00e7o\u011fu zaman recursive resolver sizin ad\u0131n\u0131za yetkili DNS sunucular\u0131na gider ve cevab\u0131 \u00f6nbelle\u011fe al\u0131r. Normal DNS yap\u0131s\u0131nda resolver, ald\u0131\u011f\u0131 cevab\u0131n ger\u00e7ekten alan ad\u0131 sahibinden geldi\u011fini kriptografik olarak kan\u0131tlayamaz.<\/p>\n<p>Bu bo\u015fluk, DNS \u00f6nbellek zehirlenmesi veya araya giren sahte cevap sald\u0131r\u0131lar\u0131 i\u00e7in kullan\u0131labilir. Sald\u0131rgan, kullan\u0131c\u0131 do\u011fru alan ad\u0131n\u0131 yazd\u0131\u011f\u0131 halde onu kendi sunucusuna y\u00f6nlendirmeye \u00e7al\u0131\u015fabilir. HTTPS sertifika uyar\u0131s\u0131 baz\u0131 sald\u0131r\u0131lar\u0131 g\u00f6r\u00fcn\u00fcr k\u0131lar; fakat kullan\u0131c\u0131 uyar\u0131y\u0131 g\u00f6rmezden gelebilir veya sald\u0131rgan ba\u015fka bir hizmeti taklit etmeye \u00e7al\u0131\u015fabilir.<\/p>\n<p>DNSSEC burada imza zincirini devreye sokar. Resolver, &#8220;Bu IP adresi ger\u00e7ekten bu alan ad\u0131n\u0131n yetkili kayd\u0131ndan m\u0131 geliyor?&#8221; sorusunu yaln\u0131zca sunucunun beyan\u0131yla de\u011fil, do\u011frulanabilir kriptografik kay\u0131tlarla yan\u0131tlar. \u0130mza ge\u00e7ersizse do\u011frulama yapan resolver cevab\u0131 kabul etmez ve \u00e7o\u011fu durumda <code>SERVFAIL<\/code> d\u00f6nd\u00fcr\u00fcr.<\/p>\n<h2><span id=\"Imza_zinciri_hangi_kayitlardan_olusur\">\u0130mza zinciri hangi kay\u0131tlardan olu\u015fur?<\/span><\/h2>\n<p>DNSSEC terimleri ilk bak\u0131\u015fta kalabal\u0131k gelebilir. Destek biletlerinde anlat\u0131rken \u015fu d\u00f6rt kayd\u0131 ayr\u0131 ayr\u0131 ele al\u0131yorum:<\/p>\n<ul>\n<li><strong>DNSKEY:<\/strong> Alan ad\u0131n\u0131n DNSSEC anahtarlar\u0131n\u0131 i\u00e7erir. Y\u00f6netilen hizmetlerde ayr\u0131nt\u0131lar gizlenebilir; kendi BIND kurulumlar\u0131nda genellikle KSK ve ZSK rollerini g\u00f6r\u00fcrs\u00fcn\u00fcz.<\/li>\n<li><strong>RRSIG:<\/strong> A, MX ve TXT gibi DNS kay\u0131t k\u00fcmelerinin dijital imzas\u0131d\u0131r. Resolver bu imzay\u0131 uygun DNSKEY ile do\u011frular.<\/li>\n<li><strong>DS:<\/strong> Delegation Signer kayd\u0131d\u0131r. Alan ad\u0131n\u0131n DNSKEY kayd\u0131n\u0131n \u00f6zetini \u00fcst b\u00f6lgeye ta\u015f\u0131r. TLD ile alan ad\u0131n\u0131z aras\u0131ndaki g\u00fcven zincirinin ba\u011flant\u0131s\u0131d\u0131r.<\/li>\n<li><strong>NSEC veya NSEC3:<\/strong> Bir kayd\u0131n mevcut olmad\u0131\u011f\u0131n\u0131 kan\u0131tlamak i\u00e7in kullan\u0131l\u0131r. DNSSEC yaln\u0131zca &#8220;bu kay\u0131t var&#8221; cevab\u0131n\u0131 de\u011fil, &#8220;bu isimde kay\u0131t yok&#8221; cevab\u0131n\u0131 da do\u011frulamaya \u00e7al\u0131\u015f\u0131r.<\/li>\n<\/ul>\n<p>Ak\u0131\u015f basit\u00e7e \u015f\u00f6yledir: k\u00f6k DNS b\u00f6lgesi TLD b\u00f6lgesine g\u00fcvenir; TLD b\u00f6lgesi alan ad\u0131n\u0131z\u0131n DS kayd\u0131n\u0131 yay\u0131mlar; DS kayd\u0131 alan ad\u0131n\u0131z\u0131n DNSKEY kayd\u0131n\u0131 do\u011frulamaya yard\u0131m eder; DNSKEY de A, MX ve di\u011fer kay\u0131tlar\u0131n RRSIG imzalar\u0131n\u0131 do\u011frular.<\/p>\n<p>Zincirin tek bir halkas\u0131 bile uyu\u015fmazsa do\u011frulama ba\u015far\u0131s\u0131z olur. DNS sa\u011flay\u0131c\u0131n\u0131zda DNSSEC a\u00e7\u0131k g\u00f6r\u00fcn\u00fcrken registrar taraf\u0131ndaki DS kayd\u0131 eskiyse zincir kopar. Paneldeki ye\u015fil i\u015faret tek ba\u015f\u0131na kan\u0131t de\u011fildir; d\u0131\u015far\u0131dan sorgu gerekir.<\/p>\n<h3><span id=\"KSK_ve_ZSK_farki\">KSK ve ZSK fark\u0131<\/span><\/h3>\n<p>DNSSEC kurulumlar\u0131nda iki anahtar rol\u00fcyle kar\u015f\u0131la\u015fman\u0131z yayg\u0131nd\u0131r. Zone Signing Key, yani ZSK, b\u00f6lgedeki normal DNS kay\u0131tlar\u0131n\u0131 imzalar. Key Signing Key, yani KSK, DNSKEY k\u00fcmesini imzalar ve bu anahtar\u0131n \u00f6zeti DS kayd\u0131 olarak \u00fcst b\u00f6lgeye yaz\u0131l\u0131r.<\/p>\n<p>Bu ayr\u0131m anahtar yenileme i\u015flemlerini daha kontroll\u00fc k\u0131lar. ZSK daha s\u0131k de\u011fi\u015ftirilebilir; KSK de\u011fi\u015fti\u011finde DS kayd\u0131n\u0131n da g\u00fcncellenmesi gerekir. Baz\u0131 y\u00f6netilen DNS servisleri bu i\u015flemleri otomatik y\u00fcr\u00fct\u00fcr. Kendi BIND sunucunuzu i\u015fletiyorsan\u0131z otomasyonun ger\u00e7ekten \u00e7al\u0131\u015ft\u0131\u011f\u0131n\u0131 izleyin. &#8220;Cron \u00e7al\u0131\u015f\u0131yordur&#8221; varsay\u0131m\u0131, sertifika yenilemede oldu\u011fu gibi DNSSEC&#8217;te de pahal\u0131 olabilir.<\/p>\n<h2><span id=\"DNSSEC_ile_HTTPS_ayni_sey_degildir\">DNSSEC ile HTTPS ayn\u0131 \u015fey de\u011fildir<\/span><\/h2>\n<p>Bu iki teknoloji s\u0131k kar\u0131\u015ft\u0131r\u0131l\u0131yor. HTTPS, taray\u0131c\u0131 ile web sunucusu aras\u0131ndaki ba\u011flant\u0131y\u0131 TLS ile korur. DNSSEC ise DNS cevab\u0131n\u0131n do\u011frulu\u011funu kontrol eder. SSL\/TLS sertifikan\u0131z\u0131n olmas\u0131, DNS kayd\u0131n\u0131z\u0131n sahte bir resolver cevab\u0131yla de\u011fi\u015ftirilmesini tek ba\u015f\u0131na engellemez.<\/p>\n<table>\n<thead>\n<tr>\n<th>Teknoloji<\/th>\n<th>Korudu\u011fu b\u00f6l\u00fcm<\/th>\n<th>Temel amac\u0131<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>DNSSEC<\/td>\n<td>DNS cevaplar\u0131n\u0131n do\u011frulu\u011fu<\/td>\n<td>Alan ad\u0131 kay\u0131tlar\u0131n\u0131n sahte veya de\u011fi\u015ftirilmi\u015f olmad\u0131\u011f\u0131n\u0131 do\u011frulamak<\/td>\n<\/tr>\n<tr>\n<td>HTTPS \/ TLS<\/td>\n<td>Taray\u0131c\u0131 ile sunucu aras\u0131ndaki ba\u011flant\u0131<\/td>\n<td>Veriyi \u015fifrelemek ve sunucunun kimli\u011fini sertifika ile do\u011frulamak<\/td>\n<\/tr>\n<tr>\n<td>SPF, DKIM, DMARC<\/td>\n<td>E-posta g\u00f6nderim ve kimlik do\u011frulamas\u0131<\/td>\n<td>Alan ad\u0131n\u0131z ad\u0131na sahte e-posta g\u00f6nderimini azaltmak<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<p>DNSSEC etkin bir alan ad\u0131nda HTTPS sertifikan\u0131z\u0131 kullanmaya devam edersiniz. E-posta g\u00fcvenli\u011fi i\u00e7in SPF, DKIM ve DMARC kay\u0131tlar\u0131n\u0131 da ayr\u0131ca yap\u0131land\u0131rman\u0131z gerekir. Birinin kurulmas\u0131 di\u011ferinin yerini tutmaz.<\/p>\n<h2><span id=\"Etkinlestirmeden_once_DNS_mimarisini_netlestirin\">Etkinle\u015ftirmeden \u00f6nce DNS mimarisini netle\u015ftirin<\/span><\/h2>\n<p>DNSSEC&#8217;i tek d\u00fc\u011fmeyle a\u00e7mak m\u00fcmk\u00fcn olabilir; ben yine de \u00f6nce DNS&#8217;in nerede y\u00f6netildi\u011fini yazar\u0131m. Registrar, yetkili DNS sa\u011flay\u0131c\u0131s\u0131 ve hosting sunucusu ayn\u0131 \u015firket olmak zorunda de\u011fildir.<\/p>\n<ol>\n<li><strong>Yetkili DNS sunucular\u0131n\u0131 belirleyin.<\/strong> Registrar panelindeki nameserver de\u011ferlerine bak\u0131n. DNS kay\u0131tlar\u0131n\u0131 ger\u00e7ekten hangi servis yay\u0131ml\u0131yor, bunu bilin.<\/li>\n<li><strong>Sa\u011flay\u0131c\u0131n\u0131n DNSSEC y\u00f6ntemini \u00f6\u011frenin.<\/strong> Baz\u0131 paneller otomatik imza \u00fcretir, baz\u0131lar\u0131 sizden DS bilgisi ister. \u0130ki y\u00f6ntemi rastgele birlikte uygulamay\u0131n.<\/li>\n<li><strong>Mevcut kay\u0131tlar\u0131 d\u0131\u015far\u0131 al\u0131n.<\/strong> A, AAAA, MX, TXT, CNAME, CAA ve varsa \u00f6zel SRV kay\u0131tlar\u0131n\u0131 kaydedin. DNS kay\u0131t t\u00fcrlerini kar\u0131\u015ft\u0131r\u0131yorsan\u0131z <a href=\"https:\/\/www.dchost.com\/blog\/dns-kayit-turleri-nedir-a-aaaa-mx-cname-txt-srv-ve-caa-icin-uygulamali-rehber\/\">DNS Kay\u0131t T\u00fcrleri Nedir? A, AAAA, MX, CNAME, TXT, SRV ve CAA \u0130\u00e7in Uygulamal\u0131 Rehber<\/a> ba\u015fl\u0131kl\u0131 i\u00e7eri\u011fimizdeki \u00f6rnekler i\u015finize yarayabilir.<\/li>\n<li><strong>\u0130kincil DNS veya DNS proxy kullan\u0131p kullanmad\u0131\u011f\u0131n\u0131z\u0131 kontrol edin.<\/strong> CDN, WAF ve registrar DNS&#8217;i ayn\u0131 anda devredeyse imzay\u0131 hangi taraf\u0131n \u00fcretti\u011fi kesin olmal\u0131.<\/li>\n<li><strong>Alternatif ileti\u015fim y\u00f6ntemi haz\u0131rlay\u0131n.<\/strong> DNSSEC hatas\u0131nda alan ad\u0131na ba\u011fl\u0131 e-posta adresiniz de \u00e7al\u0131\u015fmayabilir. Registrar hesab\u0131ndaki telefon ve alternatif e-posta bilgilerini kontrol edin.<\/li>\n<\/ol>\n<p>Nameserver de\u011fi\u015fikli\u011fi yapacaksan\u0131z DNSSEC durumunu i\u015flem plan\u0131na ekleyin. Alan ad\u0131 transferinde DNS&#8217;in nerede tutuldu\u011funu ve DS kayd\u0131n\u0131n nas\u0131l ta\u015f\u0131naca\u011f\u0131n\u0131 ayr\u0131ca kontrol edin. Alan ad\u0131 Transferi Nas\u0131l Yap\u0131l\u0131r? Ad\u0131m Ad\u0131m Rehber ba\u015fl\u0131\u011f\u0131ndaki ta\u015f\u0131ma ad\u0131mlar\u0131na DNSSEC kontrol\u00fc eklemek, sonradan \u00e7\u0131kabilecek <code>SERVFAIL<\/code> sorunlar\u0131n\u0131 azalt\u0131r.<\/p>\n<h2><span id=\"Panel_uzerinden_DNSSEC_kurulumu\">Panel \u00fczerinden DNSSEC kurulumu<\/span><\/h2>\n<p>Y\u00f6netilen DNS servislerinde i\u015flem \u00e7o\u011funlukla \u00fc\u00e7 par\u00e7al\u0131d\u0131r: DNSSEC&#8217;i yetkili DNS sa\u011flay\u0131c\u0131s\u0131nda etkinle\u015ftirmek, olu\u015fan DS bilgisini registrar&#8217;a girmek ve d\u0131\u015far\u0131dan do\u011frulamak. Baz\u0131 registrar&#8217;lar API entegrasyonu sayesinde DS kayd\u0131n\u0131 otomatik ekler.<\/p>\n<p>Panel DS bilgisi istiyorsa genellikle \u015fu alanlar\u0131 g\u00f6r\u00fcrs\u00fcn\u00fcz:<\/p>\n<ul>\n<li>Key tag<\/li>\n<li>Algorithm<\/li>\n<li>Digest type<\/li>\n<li>Digest<\/li>\n<\/ul>\n<p>Bu de\u011ferleri elle yazarken tek bir karakter hatas\u0131 bile zinciri bozabilir. Kopyalama s\u0131ras\u0131nda ba\u015fta veya sonda bo\u015fluk kalmad\u0131\u011f\u0131n\u0131 kontrol edin. DS kayd\u0131n\u0131 registrar&#8217;a eklemeden \u00f6nce DNS sa\u011flay\u0131c\u0131s\u0131n\u0131n \u00fcretti\u011fi de\u011ferle kar\u015f\u0131la\u015ft\u0131r\u0131n; eski anahtara ait bilgiyi kullanmay\u0131n.<\/p>\n<p>Birden fazla DS kayd\u0131 g\u00f6r\u00fcyorsan\u0131z hepsini geli\u015fig\u00fczel silmeyin. Eski ve yeni anahtar\u0131n birlikte ge\u00e7erli oldu\u011fu kontroll\u00fc ge\u00e7i\u015fler olabilir. Sa\u011flay\u0131c\u0131n\u0131n anahtar d\u00f6nd\u00fcrme prosed\u00fcr\u00fcn\u00fc izleyin. Kendi anahtarlar\u0131n\u0131z\u0131 y\u00f6netmiyorsan\u0131z, panelin otomatik DNSSEC ak\u0131\u015f\u0131 genellikle daha az el i\u015fi ve daha az hata demektir.<\/p>\n<h2><span id=\"Linux_uzerinden_DNSSEC_dogrulama\">Linux \u00fczerinden DNSSEC do\u011frulama<\/span><\/h2>\n<p>DNS \u015fik\u00e2yetlerinde panele g\u00fcvenmeden \u00f6nce ben <code>dig<\/code> ile d\u0131\u015far\u0131dan bakar\u0131m. Temel sorgu \u015f\u00f6yle:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">dig example.com A +dnssec<\/code><\/pre>\n<p>\u00c7\u0131kt\u0131da <code>RRSIG<\/code> kayd\u0131n\u0131 g\u00f6rmek, sunucunun imza bilgisini d\u00f6nd\u00fcrd\u00fc\u011f\u00fcn\u00fc g\u00f6sterir. Cevap b\u00f6l\u00fcm\u00fcndeki <code>ad<\/code> bayra\u011f\u0131 ise sorguyu yapan resolver&#8217;\u0131n cevab\u0131 do\u011frulad\u0131\u011f\u0131n\u0131 belirtir. <code>+dnssec<\/code> tek ba\u015f\u0131na do\u011frulama yapmaz; bu ayr\u0131m s\u0131k atlan\u0131yor.<\/p>\n<p>DS kayd\u0131n\u0131 \u00fcst b\u00f6lgeden kontrol etmek i\u00e7in:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">dig example.com DS +short<\/code><\/pre>\n<p>Buradaki digest de\u011ferini DNS sa\u011flay\u0131c\u0131s\u0131n\u0131n yay\u0131mlad\u0131\u011f\u0131 DNSKEY \u00f6zetiyle kar\u015f\u0131la\u015ft\u0131rabilirsiniz. Yetkili sunucular\u0131 do\u011frudan sorgulamak i\u00e7in \u00f6nce nameserver listesini al\u0131n:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">dig example.com NS +short\ndig @ns1.example-dns.net example.com DNSKEY +dnssec<\/code><\/pre>\n<p>\u0130lk komut yetkili sunucular\u0131, ikinci komut ise bu sunucunun DNSKEY ve imza bilgisini g\u00f6sterir. \u00d6rnek alan ad\u0131n\u0131 kendi alan ad\u0131n\u0131zla, nameserver de\u011ferini de ger\u00e7ek sunucunuzla de\u011fi\u015ftirin.<\/p>\n<p>Yerel resolver&#8217;\u0131n DNSSEC do\u011frulamas\u0131n\u0131 daha belirgin g\u00f6rmek i\u00e7in <code>delv<\/code> kullanabilirsiniz:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">delv example.com A<\/code><\/pre>\n<p>Do\u011frulama ba\u015far\u0131l\u0131ysa \u00e7\u0131kt\u0131da g\u00fcven zincirine ili\u015fkin bilgi g\u00f6r\u00fcrs\u00fcn\u00fcz. <code>broken trust chain<\/code>, <code>no valid signature<\/code> veya benzeri bir hata al\u0131rsan\u0131z DS, DNSKEY ve RRSIG de\u011ferlerini birlikte inceleyin. Yaln\u0131zca A kayd\u0131na bakmak sorunun kayna\u011f\u0131n\u0131 gizleyebilir.<\/p>\n<h2><span id=\"Etkinlestirdikten_sonra_hangi_testleri_yaparim\">Etkinle\u015ftirdikten sonra hangi testleri yapar\u0131m?<\/span><\/h2>\n<p>Kontrol\u00fc yaln\u0131zca kendi bilgisayar\u0131n\u0131zdan yapmay\u0131n. Farkl\u0131 recursive resolver&#8217;lar, mobil internet ve kurumsal a\u011flar \u00fczerinden sorgu ger\u00e7ekle\u015ftirin. \u00d6nbellekler farkl\u0131 s\u00fcrelerde yenilenebildi\u011fi i\u00e7in de\u011fi\u015fiklikten hemen sonra b\u00fct\u00fcn cevaplar\u0131n ayn\u0131 olmas\u0131n\u0131 beklemek do\u011fru de\u011fildir.<\/p>\n<p>Benim pratik test s\u0131ram \u015fu:<\/p>\n<ol>\n<li>Alan ad\u0131n\u0131n A ve AAAA kay\u0131tlar\u0131n\u0131 sorgulay\u0131n.<\/li>\n<li>MX kay\u0131tlar\u0131n\u0131n do\u011fruland\u0131\u011f\u0131n\u0131 kontrol edin; e-posta ak\u0131\u015f\u0131n\u0131 unutmay\u0131n.<\/li>\n<li>TXT kay\u0131tlar\u0131n\u0131 sorgulay\u0131n ve SPF, DKIM ile alan ad\u0131 do\u011frulama kay\u0131tlar\u0131n\u0131n d\u00f6nd\u00fc\u011f\u00fcn\u00fc g\u00f6r\u00fcn.<\/li>\n<li>DS kayd\u0131n\u0131 TLD seviyesinden kontrol edin.<\/li>\n<li>DNSSEC do\u011frulamas\u0131 yapan bir resolver \u00fczerinden <code>dig<\/code> veya <code>delv<\/code> \u00e7al\u0131\u015ft\u0131r\u0131n.<\/li>\n<li>En az iki yetkili nameserver&#8217;\u0131n ayn\u0131 DNSKEY ve imza durumunu verdi\u011fini do\u011frulay\u0131n.<\/li>\n<\/ol>\n<p>Web sitesi a\u00e7\u0131l\u0131yor diye kontrol\u00fc bitirmeyin. Bir\u00e7ok ekip A kayd\u0131na bak\u0131p MX ve TXT taraf\u0131n\u0131 unutuyor. E-posta teslimat\u0131 veya alan ad\u0131 do\u011frulamas\u0131 kullanan servisler, zincirdeki bir sorunu taray\u0131c\u0131dan \u00f6nce g\u00f6sterebilir.<\/p>\n<h2><span id=\"SERVFAIL_gordugunuzde_ilk_bakacaginiz_yerler\">SERVFAIL g\u00f6rd\u00fc\u011f\u00fcn\u00fczde ilk bakaca\u011f\u0131n\u0131z yerler<\/span><\/h2>\n<p>DNSSEC kaynakl\u0131 hata \u00e7o\u011fu zaman &#8220;site tamamen kapal\u0131&#8221; gibi g\u00f6r\u00fcn\u00fcr. \u00d6nce sorunun b\u00fct\u00fcn istemcilerde mi, yoksa belirli resolver&#8217;larda m\u0131 ya\u015fand\u0131\u011f\u0131n\u0131 ay\u0131r\u0131n. Farkl\u0131 do\u011frulay\u0131c\u0131lar\u0131 kar\u015f\u0131la\u015ft\u0131rmak i\u00e7in:<\/p>\n<pre class=\"language-bash line-numbers\"><code class=\"language-bash\">dig @1.1.1.1 example.com A\ndig @8.8.8.8 example.com A<\/code><\/pre>\n<p>Ard\u0131ndan \u015fu ihtimalleri kontrol edin:<\/p>\n<ul>\n<li>Registrar&#8217;daki DS kayd\u0131 eski DNS sa\u011flay\u0131c\u0131s\u0131na ait olabilir.<\/li>\n<li>DNS sa\u011flay\u0131c\u0131s\u0131 de\u011fi\u015fmi\u015f, fakat yeni DNSKEY bilgisi \u00fcst b\u00f6lgeye i\u015flenmemi\u015f olabilir.<\/li>\n<li>Bir kay\u0131t de\u011fi\u015ftirilmi\u015f, fakat yeni RRSIG imzas\u0131 \u00fcretilmemi\u015f olabilir.<\/li>\n<li>DNS sunucusunun saat bilgisi hatal\u0131 olabilir. RRSIG kay\u0131tlar\u0131n\u0131n ge\u00e7erlilik aral\u0131\u011f\u0131 vard\u0131r; ciddi saat sapmas\u0131 do\u011frulamay\u0131 bozabilir.<\/li>\n<li>Yetkili nameserver&#8217;lardan biri eski zone dosyas\u0131n\u0131 yay\u0131ml\u0131yor olabilir.<\/li>\n<li>DNSSEC anahtar d\u00f6nd\u00fcrme i\u015flemi yar\u0131da kalm\u0131\u015f olabilir.<\/li>\n<\/ul>\n<p>Bu komutlarla iki farkl\u0131 do\u011frulay\u0131c\u0131n\u0131n ayn\u0131 cevab\u0131 verip vermedi\u011fini kar\u015f\u0131la\u015ft\u0131rd\u0131k.<\/p>\n<p>Ge\u00e7ici \u00e7\u00f6z\u00fcm olarak DS kayd\u0131n\u0131 silmek bazen \u00f6nerilir. Bu i\u015flem do\u011frulamay\u0131 kapat\u0131r ve yanl\u0131\u015f yap\u0131land\u0131rman\u0131n neden oldu\u011fu eri\u015fim sorununu kald\u0131rabilir; DNSSEC korumas\u0131ndan da vazge\u00e7mi\u015f olursunuz. \u00d6nce hatan\u0131n kayna\u011f\u0131n\u0131 bulun. Eri\u015filebilirlik bask\u0131s\u0131 nedeniyle DS kald\u0131r\u0131l\u0131rsa karar\u0131 kayda al\u0131n ve d\u00fczeltme tamamlan\u0131nca DNSSEC&#8217;i yeniden kurun.<\/p>\n<p>Benim Proxmox lab&#8217;\u0131ndaki KSK d\u00f6nd\u00fcrme hatas\u0131nda <code>dig +trace<\/code> ile k\u00f6kten ba\u015flay\u0131p TLD ve yetkili sunuculara kadar zinciri izledim. DS yeni anahtar\u0131 g\u00f6steriyordu, fakat yetkili sunuculardan biri eski DNSKEY k\u00fcmesini yay\u0131ml\u0131yordu. Test alan\u0131yd\u0131; \u00fcretimde ayn\u0131 i\u015flem i\u00e7in de\u011fi\u015fiklik plan\u0131 ve geri d\u00f6n\u00fc\u015f kayd\u0131 olmadan ilerlemem.<\/p>\n<h2><span id=\"DNSSEC8217in_sinirlari_ve_bakim_isi\">DNSSEC&#8217;in s\u0131n\u0131rlar\u0131 ve bak\u0131m i\u015fi<\/span><\/h2>\n<p>DNSSEC g\u00fc\u00e7l\u00fc bir do\u011frulama katman\u0131d\u0131r, fakat registrar hesab\u0131n\u0131z\u0131 korumaz. Hesap ele ge\u00e7irilirse sald\u0131rgan nameserver&#8217;lar\u0131 de\u011fi\u015ftirebilir veya DS kayd\u0131n\u0131 y\u00f6netebilir. Registrar hesab\u0131nda \u00e7ok fakt\u00f6rl\u00fc kimlik do\u011frulama kullan\u0131n, kurtarma e-posta adresini koruyun ve yetkili ki\u015fileri s\u0131n\u0131rlay\u0131n.<\/p>\n<p>DNSSEC web sunucusundaki a\u00e7\u0131klar\u0131 da kapatmaz. WordPress eklentiniz eskiyse, y\u00f6netici parolan\u0131z <code>123456<\/code> ise veya sunucunuzda yanl\u0131\u015f izinler varsa DNSSEC bunlar\u0131n hi\u00e7birini d\u00fczeltmez. Yaln\u0131zca DNS kayd\u0131n\u0131n do\u011fru IP&#8217;ye i\u015faret etti\u011fini do\u011frular; o IP&#8217;de \u00e7al\u0131\u015fan uygulaman\u0131n g\u00fcvenli oldu\u011funu kan\u0131tlamaz.<\/p>\n<p>Yanl\u0131\u015f imzalanm\u0131\u015f bir kay\u0131t, imzas\u0131z bir kay\u0131ttan daha sert sonu\u00e7 do\u011furabilir; do\u011frulayan resolver cevab\u0131 reddeder. DNSSEC anahtarlar\u0131n\u0131, imza s\u00fcrelerini ve DS de\u011fi\u015fikliklerini izleyin. Kendi DNS altyap\u0131n\u0131z\u0131 y\u00f6netiyorsan\u0131z de\u011fi\u015fiklikleri loglay\u0131n, alarm \u00fcretin ve geri d\u00f6n\u00fc\u015f ad\u0131m\u0131n\u0131 \u00f6nceden yaz\u0131n.<\/p>\n<p>Nameserver performans\u0131, TTL de\u011ferleri ve resolver davran\u0131\u015f\u0131 \u00f6nemini korur. <a href=\"https:\/\/www.dchost.com\/blog\/dns-performansini-olcmek-ve-iyilestirmek-anycast-coklu-dns-saglayici-ve-health-check-mimarisi\/\">DNS Performans\u0131n\u0131 \u00d6l\u00e7mek ve \u0130yile\u015ftirmek: Anycast, \u00c7oklu DNS Sa\u011flay\u0131c\u0131 ve Health Check Mimarisi<\/a> ba\u015fl\u0131\u011f\u0131nda bu konular\u0131 farkl\u0131 bir a\u00e7\u0131dan ele al\u0131yoruz. DNSSEC imza ekler; k\u00f6t\u00fc tasarlanm\u0131\u015f bir DNS mimarisini kendili\u011finden h\u0131zl\u0131 veya dayan\u0131kl\u0131 yapmaz.<\/p>\n<h2><span id=\"Alan_adiniz_icin_uygulanabilir_bir_DNSSEC_plani\">Alan ad\u0131n\u0131z i\u00e7in uygulanabilir bir DNSSEC plan\u0131<\/span><\/h2>\n<p>K\u00fc\u00e7\u00fck bir WordPress sitesi i\u00e7in tercihim, DNSSEC deste\u011fi ve anahtar d\u00f6nd\u00fcrme otomasyonu bulunan bir DNS sa\u011flay\u0131c\u0131s\u0131 kullanmak. \u00d6nce mevcut zone kay\u0131tlar\u0131n\u0131 d\u0131\u015far\u0131 al\u0131r\u0131m, DNSSEC&#8217;i sa\u011flay\u0131c\u0131 taraf\u0131nda a\u00e7ar\u0131m, olu\u015fan DS bilgisini registrar&#8217;a girerim ve farkl\u0131 resolver&#8217;larla do\u011frulama yapar\u0131m. De\u011fi\u015fikli\u011fi tarih, DS digest ve sa\u011flay\u0131c\u0131 bilgisiyle kay\u0131t alt\u0131na al\u0131r\u0131m.<\/p>\n<p>Birden fazla site veya e-ticaret altyap\u0131s\u0131 y\u00f6netiyorsan\u0131z s\u00fcre\u00e7 daha s\u0131k\u0131 olmal\u0131. DNS sa\u011flay\u0131c\u0131s\u0131n\u0131n bak\u0131m duyurular\u0131n\u0131 takip edin, registrar eri\u015fimini tek ki\u015finin hesab\u0131na b\u0131rakmay\u0131n ve DS de\u011fi\u015fiklikleri i\u00e7in onay mekanizmas\u0131 kullan\u0131n. DNS de\u011fi\u015fikli\u011fi tek sat\u0131r gibi g\u00f6r\u00fcn\u00fcr; yanl\u0131\u015f sat\u0131r m\u00fc\u015fterilerin e-posta, web sitesi ve \u00fc\u00e7\u00fcnc\u00fc taraf API eri\u015fimlerini ayn\u0131 anda etkileyebilir.<\/p>\n<p>Ta\u015f\u0131ma plan\u0131na \u015fu maddeleri ekleyin:<\/p>\n<ul>\n<li>Mevcut DS ve DNSKEY de\u011ferlerini kaydetmek<\/li>\n<li>Yeni yetkili DNS sunucusunda DNSSEC durumunu do\u011frulamak<\/li>\n<li>DS kayd\u0131n\u0131 yaln\u0131zca yeni anahtar haz\u0131r olduktan sonra de\u011fi\u015ftirmek<\/li>\n<li>Eski DNS sa\u011flay\u0131c\u0131s\u0131n\u0131 hemen kapatmamak<\/li>\n<li>Farkl\u0131 resolver&#8217;larla A, AAAA, MX ve TXT sorgular\u0131 yapmak<\/li>\n<li>\u0130mzalar\u0131n ge\u00e7erlili\u011fi ve nameserver tutarl\u0131l\u0131\u011f\u0131 i\u00e7in izleme kurmak<\/li>\n<\/ul>\n<p>Evdeki lab&#8217;da test alan\u0131n\u0131 birka\u00e7 dakika eri\u015filemez duruma sokmam \u00fcretimde i\u015fime yarayan bir hatayd\u0131. M\u00fc\u015fteri yoktu, kahvem vard\u0131. \u00dcretimde DNSSEC de\u011fi\u015fikli\u011fini bak\u0131m plan\u0131, do\u011frulama ad\u0131mlar\u0131 ve geri d\u00f6n\u00fc\u015f kayd\u0131 olmadan yapm\u0131yorum.<\/p>\n<h2><span id=\"Sik_Sorulan_Sorular\">S\u0131k Sorulan Sorular<\/span><\/h2>\n<h3><span id=\"DNSSEC_nedir_her_alan_adi_icin_gerekli_midir\">DNSSEC nedir, her alan ad\u0131 i\u00e7in gerekli midir?<\/span><\/h3>\n<p>DNSSEC, DNS cevaplar\u0131n\u0131n yetkili kaynaktan geldi\u011fini ve de\u011fi\u015ftirilmedi\u011fini do\u011frulayan bir g\u00fcvenlik katman\u0131d\u0131r. Her alan ad\u0131 i\u00e7in zorunlu de\u011fildir; alan ad\u0131 ele ge\u00e7irme, sahte DNS cevab\u0131 ve kritik e-posta kay\u0131tlar\u0131n\u0131n de\u011fi\u015ftirilmesi risklerini azaltmak isteyen siteler i\u00e7in de\u011ferlidir.<\/p>\n<h3><span id=\"DNSSEC_web_sitesini_yavaslatir_mi\">DNSSEC web sitesini yava\u015flat\u0131r m\u0131?<\/span><\/h3>\n<p>DNS cevaplar\u0131na imza ve do\u011frulama bilgileri eklendi\u011fi i\u00e7in yan\u0131t boyutu artabilir. D\u00fczg\u00fcn yap\u0131land\u0131r\u0131lm\u0131\u015f bir DNS hizmetinde bu durum genellikle kullan\u0131c\u0131 taraf\u0131ndan fark edilen bir web sitesi yava\u015fl\u0131\u011f\u0131 olu\u015fturmaz. Nameserver performans\u0131, TTL ve resolver se\u00e7imi ayr\u0131ca de\u011ferlendirilmelidir.<\/p>\n<h3><span id=\"DNSSEC_acinca_SSL_sertifikasina_hala_ihtiyac_var_mi\">DNSSEC a\u00e7\u0131nca SSL sertifikas\u0131na h\u00e2l\u00e2 ihtiya\u00e7 var m\u0131?<\/span><\/h3>\n<p>Evet. DNSSEC DNS kay\u0131tlar\u0131n\u0131n do\u011frulu\u011funu, SSL\/TLS ise taray\u0131c\u0131 ile sunucu aras\u0131ndaki ba\u011flant\u0131n\u0131n \u015fifrelenmesini ve sunucu kimli\u011fini korur. Farkl\u0131 katmanlarda \u00e7al\u0131\u015ft\u0131klar\u0131 i\u00e7in birbirlerinin alternatifi de\u011fildir.<\/p>\n<h3><span id=\"DNSSEC_sonrasi_alan_adim_SERVFAIL_veriyor_ne_yapmaliyim\">DNSSEC sonras\u0131 alan ad\u0131m SERVFAIL veriyor, ne yapmal\u0131y\u0131m?<\/span><\/h3>\n<p>\u00d6nce registrar&#8217;daki DS kayd\u0131n\u0131, yetkili sunuculardaki DNSKEY ve ilgili RRSIG kay\u0131tlar\u0131n\u0131 kar\u015f\u0131la\u015ft\u0131r\u0131n. <code>dig +trace<\/code>, <code>dig +dnssec<\/code> ve farkl\u0131 resolver sorgular\u0131 zincirin hangi noktas\u0131nda koptu\u011funu g\u00f6sterebilir. DS kayd\u0131n\u0131 silmek yaln\u0131zca kontroll\u00fc bir acil durum se\u00e7ene\u011fi olmal\u0131d\u0131r.<\/p>\n<\/div>","protected":false},"excerpt":{"rendered":"<p>DNSSEC&#8217;in DNS kay\u0131tlar\u0131n\u0131 nas\u0131l do\u011frulad\u0131\u011f\u0131n\u0131, DS, DNSKEY ve RRSIG kay\u0131tlar\u0131n\u0131n g\u00f6revlerini, kurulum ad\u0131mlar\u0131n\u0131 ve SERVFAIL sorunlar\u0131n\u0131 \u00f6\u011frenin.<\/p>\n","protected":false},"author":4,"featured_media":5048,"comment_status":"closed","ping_status":"","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[32],"tags":[390,232,391,393,231,392,394],"class_list":["post-5052","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-alan-adi","tag-alan-adi-guvenligi","tag-dns-guvenligi","tag-dns-kayitlari","tag-dnskey","tag-dnssec","tag-ds-kaydi","tag-rrsig"],"_links":{"self":[{"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/posts\/5052","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/users\/4"}],"replies":[{"embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/comments?post=5052"}],"version-history":[{"count":1,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/posts\/5052\/revisions"}],"predecessor-version":[{"id":5055,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/posts\/5052\/revisions\/5055"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/media\/5048"}],"wp:attachment":[{"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/media?parent=5052"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/categories?post=5052"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.dchost.com\/blog\/wp-json\/wp\/v2\/tags?post=5052"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}