{"id":3078,"date":"2026-10-25T12:30:00","date_gmt":"2026-10-25T09:30:00","guid":{"rendered":"https:\/\/narhost.com\/blog\/?p=3078"},"modified":"2026-10-15T11:55:05","modified_gmt":"2026-10-15T08:55:05","slug":"dnssec-gerekli-mi","status":"publish","type":"post","link":"https:\/\/narhost.com\/blog\/dnssec-gerekli-mi\/","title":{"rendered":"DNSSEC Gerekli mi, Kimler Etkinle\u015ftirmeli"},"content":{"rendered":"<div id=\"ai-ozet\" class=\"ai-box\">\n<p class=\"ai-box-title\">K\u0131saca \u00f6zet<\/p>\n<ul>\n<li>DNSSEC gerekli mi sorusunun k\u0131sa cevab\u0131: her site i\u00e7in zorunlu de\u011fildir; ziyaret\u00e7isinin sahte bir adrese y\u00f6nlendirilmesi ciddi zarar do\u011furacak siteler (\u00f6deme alan, giri\u015f yap\u0131lan, kurumsal e-posta kullanan) i\u00e7in g\u00fc\u00e7l\u00fc bir ek korumad\u0131r.<\/li>\n<li>DNSSEC, DNS yan\u0131tlar\u0131n\u0131 dijital olarak imzalar; \u00e7\u00f6z\u00fcmleyici imzay\u0131 do\u011frulayarak yan\u0131t\u0131n yolda de\u011fi\u015ftirilmedi\u011fini anlar. Trafi\u011fi \u015fifrelemez, yaln\u0131z DNS kay\u0131tlar\u0131n\u0131n do\u011frulu\u011funu korur.<\/li>\n<li>.tr ve .com.tr b\u00f6lgeleri imzal\u0131d\u0131r; TRAB\u0130S&#8217;in .tr i\u00e7in DNSSEC uygulama bildirimi bulunur. Bu, .tr alan adlar\u0131nda da g\u00fcven zinciri kurulabilece\u011fi anlam\u0131na gelir.<\/li>\n<li>Kurulum iki par\u00e7al\u0131d\u0131r: DNS&#8217;in bar\u0131nd\u0131r\u0131ld\u0131\u011f\u0131 yerde b\u00f6lge imzalan\u0131r, alan ad\u0131n\u0131n kay\u0131t kurulu\u015funda DS kayd\u0131 eklenir.<\/li>\n<li>En b\u00fcy\u00fck risk yanl\u0131\u015f y\u00f6netimdir: ad sunucusu de\u011fi\u015ftirirken eski DS kayd\u0131 kald\u0131r\u0131lmazsa alan ad\u0131 do\u011frulayan \u00e7\u00f6z\u00fcmleyicilerde tamamen eri\u015filemez olur.<\/li>\n<li>DNSSEC, HTTPS&#8217;in ve SPF\/DKIM\/DMARC&#8217;\u0131n yerini almaz; onlar\u0131n alt\u0131ndaki DNS katman\u0131n\u0131 korur.<\/li>\n<\/ul>\n<\/div>\n<p>Alan ad\u0131 panelinizde ya da cPanel&#8217;de DNSSEC adl\u0131 bir se\u00e7enek g\u00f6r\u00fcyorsunuz. A\u00e7mak g\u00fcvenli\u011fi art\u0131racak gibi duruyor ama ne i\u015fe yarad\u0131\u011f\u0131, siteyi bozup bozmayaca\u011f\u0131 ve sizin i\u00e7in gerekli olup olmad\u0131\u011f\u0131 belli de\u011fil. DNSSEC gerekli mi sorusunun cevab\u0131 sitenin ne yapt\u0131\u011f\u0131na ve DNS&#8217;i kimin, nas\u0131l y\u00f6netti\u011fine ba\u011fl\u0131d\u0131r.<\/p>\n<h2>DNSSEC Gerekli mi, \u00d6nce Ne Korur<\/h2>\n<p>DNS, alan ad\u0131n\u0131 IP adresine \u00e7eviren sistemdir ve ilk tasarland\u0131\u011f\u0131nda yan\u0131tlar\u0131n do\u011frulu\u011funu kan\u0131tlayan bir mekanizmas\u0131 yoktu. Bir sald\u0131rgan araya girip ya da bir \u00e7\u00f6z\u00fcmleyicinin \u00f6nbelle\u011fini zehirleyip sahte bir IP adresi d\u00f6nd\u00fcr\u00fcrse ziyaret\u00e7i, adres \u00e7ubu\u011funda do\u011fru alan ad\u0131n\u0131 g\u00f6rerek ba\u015fka bir sunucuya gider. <a href=\"https:\/\/www.icann.org\/resources\/pages\/dnssec-what-is-it-why-important-2019-03-05-en\" title=\"ICANN \u2014 DNSSEC nedir ve neden \u00f6nemlidir\" target=\"_blank\" rel=\"noopener\">ICANN&#8217;in DNSSEC a\u00e7\u0131klamas\u0131na<\/a> g\u00f6re DNSSEC bu yan\u0131tlara dijital imza ekler; do\u011frulama yapan \u00e7\u00f6z\u00fcmleyici imzas\u0131 tutmayan yan\u0131t\u0131 reddeder. Mekanizman\u0131n standard\u0131 <a href=\"https:\/\/www.rfc-editor.org\/rfc\/rfc4033\" title=\"RFC 4033 \u2014 DNS g\u00fcvenlik eklentilerine giri\u015f\" target=\"_blank\" rel=\"noopener\">RFC 4033<\/a>&#8216;t\u00fcr.<\/p>\n<p>DNSSEC \u015fifreleme yapmaz; DNS sorgunuzu gizlemez ve sitenin trafi\u011fini korumaz. Yapt\u0131\u011f\u0131 tek \u015fey, gelen DNS kayd\u0131n\u0131n alan ad\u0131 sahibinin yay\u0131mlad\u0131\u011f\u0131 kay\u0131t oldu\u011funu kan\u0131tlamakt\u0131r.<\/p>\n<table>\n<thead>\n<tr>\n<th>Koruma<\/th>\n<th>Ne korur<\/th>\n<th>DNSSEC&#8217;in rol\u00fc<\/th>\n<\/tr>\n<\/thead>\n<tbody>\n<tr>\n<td>HTTPS (SSL)<\/td>\n<td>Taray\u0131c\u0131 ile sunucu aras\u0131ndaki trafik<\/td>\n<td>Yerini almaz<\/td>\n<\/tr>\n<tr>\n<td>SPF, DKIM, DMARC<\/td>\n<td>E-postan\u0131n g\u00f6nderen alan ad\u0131na ait oldu\u011fu<\/td>\n<td>Yerini almaz; kay\u0131tlar\u0131n de\u011fi\u015ftirilmesini zorla\u015ft\u0131r\u0131r<\/td>\n<\/tr>\n<tr>\n<td>DNSSEC<\/td>\n<td>DNS yan\u0131t\u0131n\u0131n de\u011fi\u015ftirilmedi\u011fi<\/td>\n<td>Kendisi<\/td>\n<\/tr>\n<tr>\n<td>Kay\u0131t kurulu\u015fu kilidi<\/td>\n<td>Alan ad\u0131n\u0131n izinsiz transferi<\/td>\n<td>Ayr\u0131 bir \u00f6nlemdir<\/td>\n<\/tr>\n<\/tbody>\n<\/table>\n<figure class=\"nh-sema\"><img loading=\"lazy\" src=\"https:\/\/narhost.com\/blog\/wp-content\/uploads\/2026\/10\/dnssec-gerekli-mi-sema-narhost.webp\" alt=\"dnssec gerekli mi karar ve kurulum \u015femas\u0131 \u2014 risk de\u011ferlendirmesi, b\u00f6lge imzas\u0131, DS kayd\u0131 ve do\u011frulama\" width=\"1200\" height=\"500\" loading=\"lazy\" decoding=\"async\"><figcaption>\u0130mza DNS sa\u011flay\u0131c\u0131s\u0131nda, DS kayd\u0131 kay\u0131t kurulu\u015funda; ikisi birlikte g\u00fcven zincirini kurar.<\/figcaption><\/figure>\n<h2>Kimler DNSSEC A\u00e7mal\u0131<\/h2>\n<p>Ziyaret\u00e7inin sahte bir adrese y\u00f6nlendirilmesinin bedeli y\u00fcksek olan siteler i\u00e7in DNSSEC g\u00fc\u00e7l\u00fc bir ek katmand\u0131r: \u00f6deme ve kart bilgisi alan e-ticaret siteleri, m\u00fc\u015fteri giri\u015fi olan portallar, finans ve sa\u011fl\u0131k hizmeti veren kurumlar, kamu kurumlar\u0131 ve kurumsal e-postas\u0131 ayn\u0131 alan ad\u0131nda olan \u015firketler. Bu t\u00fcr alan adlar\u0131, sahte sitelerle kimlik av\u0131 yapanlar\u0131n da ilk hedefidir; taklit y\u00f6ntemleri <a href=\"https:\/\/narhost.com\/blog\/domain-spoofing-nedir\/\" title=\"Domain Spoofing Nedir \u2014 Narhost Blog\">domain spoofing nedir<\/a> yaz\u0131s\u0131nda anlat\u0131ld\u0131.<\/p>\n<p>Tan\u0131t\u0131m ama\u00e7l\u0131, giri\u015f ya da \u00f6deme almayan k\u00fc\u00e7\u00fck bir sitede DNSSEC zarar vermez ama getirisi s\u0131n\u0131rl\u0131d\u0131r. Burada as\u0131l \u00f6nlemler g\u00fcncel yaz\u0131l\u0131m, HTTPS ve alan ad\u0131n\u0131n kay\u0131t kurulu\u015funda g\u00fcvenli tutulmas\u0131d\u0131r.<\/p>\n<div class=\"highlight-box\">\n<p class=\"label\">Bilgi<\/p>\n<p>T\u00fcrkiye&#8217;nin \u00fclke uzant\u0131s\u0131 imzal\u0131d\u0131r: .tr ve .com.tr b\u00f6lgelerinin DS kay\u0131tlar\u0131 DNS k\u00f6k zincirinde bulunur ve TRAB\u0130S, .tr i\u00e7in bir DNSSEC uygulama bildirimi yay\u0131mlam\u0131\u015ft\u0131r. Yani .com.tr ya da .tr alan ad\u0131n\u0131zda da g\u00fcven zinciri u\u00e7tan uca kurulabilir.<\/p>\n<\/div>\n<div class=\"senaryo-block\">\n<p class=\"label\">\u00d6rnek senaryo<\/p>\n<p>Bir e-ticaret \u015firketi alan ad\u0131nda DNSSEC&#8217;i a\u00e7m\u0131\u015f, kay\u0131t kurulu\u015funda DS kayd\u0131n\u0131 eklemi\u015fti. Bir cuma ak\u015fam\u0131 DNS&#8217;i yeni bir sa\u011flay\u0131c\u0131ya ta\u015f\u0131d\u0131 ama eski DS kayd\u0131n\u0131 kald\u0131rmad\u0131. Do\u011frulama yapan \u00e7\u00f6z\u00fcmleyicileri kullanan ziyaret\u00e7iler siteye ve e-postaya ula\u015famad\u0131; sorun, DS kayd\u0131 kald\u0131r\u0131l\u0131p yeni sa\u011flay\u0131c\u0131da DNSSEC yeniden a\u00e7\u0131lana kadar s\u00fcrd\u00fc. \u015eirket sonraki ta\u015f\u0131mada s\u0131ray\u0131 izledi: \u00f6nce DS kald\u0131r\u0131ld\u0131, yay\u0131lma beklendi, sonra ad sunucular\u0131 de\u011fi\u015ftirildi ve yeni DS eklendi. Kesinti ya\u015fanmad\u0131.<\/p>\n<\/div>\n<h2>DNSSEC Nas\u0131l Etkinle\u015ftirilir<\/h2>\n<p>Kurulum iki yerde yap\u0131l\u0131r. Birincisi DNS&#8217;in bar\u0131nd\u0131r\u0131ld\u0131\u011f\u0131 yerdir: ad sunucular\u0131n\u0131z hosting firman\u0131zdaysa cPanel&#8217;deki DNSSEC arac\u0131yla b\u00f6lge imzalan\u0131r ve bir anahtar \u00fcretilir. \u0130kincisi alan ad\u0131n\u0131n kay\u0131t kurulu\u015fudur: \u00fcretilen anahtar\u0131n \u00f6zeti DS kayd\u0131 olarak alan ad\u0131na eklenir. DS kayd\u0131 eklenene kadar imza \u00fcretilmi\u015f olsa bile g\u00fcven zinciri kurulmaz. cPanel taraf\u0131ndaki ad\u0131mlar <a href=\"https:\/\/narhost.com\/destek\/dnssec-nasil-aktif-edilir\/\" title=\"DNSSEC Nas\u0131l Aktif Edilir \u2014 Narhost Destek Merkezi\">DNSSEC nas\u0131l aktif edilir<\/a> kart\u0131nda.<\/p>\n<p>DNS&#8217;iniz bir CDN ya da harici DNS sa\u011flay\u0131c\u0131s\u0131ndaysa DNSSEC o sa\u011flay\u0131c\u0131da a\u00e7\u0131l\u0131r; cPanel&#8217;deki imzan\u0131n bir etkisi olmaz. Kay\u0131tlar\u0131n genel y\u00f6netimi <a href=\"https:\/\/narhost.com\/destek\/alan-adi-dns-yonetimi-rehberi\/\" title=\"Alan Ad\u0131 DNS Y\u00f6netimi Rehberi \u2014 Narhost Destek Merkezi\">alan ad\u0131 DNS y\u00f6netimi rehberinde<\/a> anlat\u0131l\u0131yor.<\/p>\n<div class=\"warn-box\">\n<p class=\"label\">Dikkat<\/p>\n<p>DNSSEC a\u00e7\u0131k bir alan ad\u0131nda ad sunucular\u0131n\u0131 de\u011fi\u015ftirirken s\u0131ra hayati \u00f6nemdedir. \u00d6nce kay\u0131t kurulu\u015fundaki DS kayd\u0131n\u0131 kald\u0131r\u0131n, de\u011fi\u015fikli\u011fin yay\u0131lmas\u0131n\u0131 bekleyin, sonra ad sunucusunu de\u011fi\u015ftirin ve yeni sa\u011flay\u0131c\u0131da DNSSEC&#8217;i yeniden a\u00e7\u0131n. Eski DS kayd\u0131 yerinde kal\u0131rsa do\u011frulama yapan \u00e7\u00f6z\u00fcmleyiciler alan ad\u0131n\u0131z\u0131 tamamen \u00e7\u00f6zemez ve site ile e-posta birlikte eri\u015filemez olur.<\/p>\n<\/div>\n<h2>DNSSEC&#8217;in Getirdi\u011fi Y\u00fck<\/h2>\n<p>Do\u011fru kurulmu\u015f DNSSEC siteyi yava\u015flatmaz; ziyaret\u00e7i fark\u0131 hissetmez. Y\u00fck y\u00f6netimdedir: anahtarlar\u0131n s\u00fcresi, sa\u011flay\u0131c\u0131 de\u011fi\u015fikli\u011findeki s\u0131ra ve DS kayd\u0131n\u0131n g\u00fcncel tutulmas\u0131. Alan ad\u0131n\u0131 bir yerden ba\u015fka yere ta\u015f\u0131yacaksan\u0131z ya da DNS&#8217;i s\u0131k de\u011fi\u015ftiriyorsan\u0131z bu i\u015fleri planlamak gerekir. Transfer s\u00fcreci <a href=\"https:\/\/narhost.com\/blog\/domain-transfer-sureci-nasil-isler\/\" title=\"Domain Transfer S\u00fcreci Nas\u0131l \u0130\u015fler \u2014 Narhost Blog\">domain transfer s\u00fcreci nas\u0131l i\u015fler<\/a> yaz\u0131s\u0131nda anlat\u0131ld\u0131.<\/p>\n<div class=\"success-box\">\n<p class=\"label\">Sonu\u00e7<\/p>\n<p>DNSSEC gerekli mi sorusunun cevab\u0131 sitenin riskine ba\u011fl\u0131d\u0131r. \u00d6deme, giri\u015f ya da kurumsal e-posta ta\u015f\u0131yan alan adlar\u0131 i\u00e7in a\u00e7\u0131lmas\u0131 \u00f6nerilir; tan\u0131t\u0131m sitelerinde iste\u011fe ba\u011fl\u0131d\u0131r. A\u00e7arsan\u0131z DS kayd\u0131n\u0131 kay\u0131t kurulu\u015funa eklemeyi ve ad sunucusu de\u011fi\u015fikliklerinde \u00f6nce DS kayd\u0131n\u0131 kald\u0131rmay\u0131 unutmay\u0131n.<\/p>\n<\/div>\n<h2>Kontrol Listesi<\/h2>\n<ul class=\"kontrol-listesi\">\n<li>Alan ad\u0131n\u0131z\u0131n DNS&#8217;inin nerede bar\u0131nd\u0131r\u0131ld\u0131\u011f\u0131n\u0131 belirleyin.<\/li>\n<li>Sitenizde \u00f6deme, giri\u015f ya da kurumsal e-posta olup olmad\u0131\u011f\u0131na g\u00f6re karar verin.<\/li>\n<li>DNS sa\u011flay\u0131c\u0131s\u0131nda b\u00f6lgeyi imzalay\u0131n.<\/li>\n<li>Kay\u0131t kurulu\u015funda DS kayd\u0131n\u0131 ekleyin.<\/li>\n<li>Bir DNSSEC do\u011frulama arac\u0131yla g\u00fcven zincirinin tamamland\u0131\u011f\u0131n\u0131 kontrol edin.<\/li>\n<li>Ad sunucusu de\u011fi\u015fikli\u011finden \u00f6nce DS kayd\u0131n\u0131 kald\u0131rmay\u0131 s\u00fcre\u00e7 notlar\u0131n\u0131za yaz\u0131n.<\/li>\n<li>Alan ad\u0131nda kay\u0131t kurulu\u015fu transfer kilidinin etkin oldu\u011funu do\u011frulay\u0131n.<\/li>\n<\/ul>\n<div class=\"kb-faq\">\n<h2>S\u0131k\u00e7a sorulan sorular<\/h2>\n<h3>DNSSEC gerekli mi, Google s\u0131ralamas\u0131n\u0131 etkiler mi?<\/h3>\n<p>DNSSEC bir s\u0131ralama etkeni olarak bilinmiyor. De\u011feri g\u00fcvenlikte, ziyaret\u00e7inin do\u011fru sunucuya ula\u015fmas\u0131n\u0131 garanti etmektedir. S\u0131ralama i\u00e7in HTTPS, i\u00e7erik ve sitenin teknik sa\u011fl\u0131\u011f\u0131 belirleyicidir.<\/p>\n<h3>DNSSEC sitemi yava\u015flat\u0131r m\u0131?<\/h3>\n<p>Ziyaret\u00e7i a\u00e7\u0131s\u0131ndan fark edilmez. \u0130mzal\u0131 yan\u0131tlar biraz daha b\u00fcy\u00fckt\u00fcr ve do\u011frulama \u00e7\u00f6z\u00fcmleyicide yap\u0131l\u0131r; sayfa a\u00e7\u0131l\u0131\u015f s\u00fcresine etkisi ihmal edilebilir d\u00fczeydedir.<\/p>\n<h3>.com.tr alan ad\u0131mda DNSSEC kullanabilir miyim?<\/h3>\n<p>Evet. .tr ve .com.tr b\u00f6lgeleri imzal\u0131d\u0131r ve TRAB\u0130S .tr i\u00e7in DNSSEC uygulamas\u0131n\u0131 tan\u0131mlam\u0131\u015ft\u0131r. DS kayd\u0131n\u0131n eklenmesi kay\u0131t kurulu\u015funuz \u00fczerinden yap\u0131l\u0131r.<\/p>\n<h3>DNSSEC a\u00e7\u0131kken alan ad\u0131 neden \u00e7\u00f6z\u00fclmez h\u00e2le gelir?<\/h3>\n<p>En s\u0131k neden, DS kayd\u0131n\u0131n art\u0131k kullan\u0131lmayan bir anahtar\u0131 g\u00f6stermesidir: ad sunucusu de\u011fi\u015ftirilmi\u015f ya da anahtar yenilenmi\u015f ama DS g\u00fcncellenmemi\u015ftir. Do\u011frulama yapan \u00e7\u00f6z\u00fcmleyiciler bu durumda yan\u0131t\u0131 reddeder.<\/p>\n<h3>DNSSEC e-posta g\u00fcvenli\u011fini sa\u011flar m\u0131?<\/h3>\n<p>Do\u011frudan sa\u011flamaz. E-postan\u0131n kimli\u011fini SPF, DKIM ve DMARC kay\u0131tlar\u0131 do\u011frular. DNSSEC bu kay\u0131tlar\u0131n yolda de\u011fi\u015ftirilmesini zorla\u015ft\u0131rarak onlar\u0131 dolayl\u0131 olarak g\u00fc\u00e7lendirir.<\/p>\n<\/div>\n<div class=\"cta-box\">\n<p class=\"label\">Narhost&#8217;ta<\/p>\n<p>Alan ad\u0131n\u0131z\u0131 Narhost&#8217;ta kaydedebilir, DNS&#8217;ini cPanel&#8217;den y\u00f6netebilir ve DNSSEC arac\u0131yla b\u00f6lgenizi imzalayabilirsiniz.<\/p>\n<p><a class=\"cta-btn\" href=\"https:\/\/narhost.com\/domain-kaydi\" title=\"Narhost alan ad\u0131 kayd\u0131 ve sorgulama\">Alan ad\u0131 sorgula<\/a><\/div>\n","protected":false},"excerpt":{"rendered":"<p>DNSSEC gerekli mi sorusunun k\u0131sa cevab\u0131: her site i\u00e7in zorunlu de\u011fil; \u00f6deme alan, giri\u015f yap\u0131lan ya da kurumsal e-posta kullanan siteler i\u00e7in g\u00fc\u00e7l\u00fc bir ek korumad\u0131r. .tr ve .com.tr b\u00f6lgeleri imzal\u0131d\u0131r; kurulum DNS sa\u011flay\u0131c\u0131s\u0131nda imza ve kay\u0131t kurulu\u015funda DS kayd\u0131yla yap\u0131l\u0131r.<\/p>\n","protected":false},"author":1,"featured_media":3079,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[18],"tags":[],"class_list":["post-3078","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-domain"],"_links":{"self":[{"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/posts\/3078","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/comments?post=3078"}],"version-history":[{"count":1,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/posts\/3078\/revisions"}],"predecessor-version":[{"id":3080,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/posts\/3078\/revisions\/3080"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/media\/3079"}],"wp:attachment":[{"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/media?parent=3078"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/categories?post=3078"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/narhost.com\/blog\/wp-json\/wp\/v2\/tags?post=3078"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}