Altyap\u0131 ve DNS<\/h2>\n
\u0130lk olarak mail sunucusu kurarken ba\u015far\u0131n\u0131n %50’si sunucu konfig\u00fcrasyonunda, geri kalan %50’si ise a\u011f altyap\u0131n\u0131z\u0131n temizli\u011findedir. Blacklist’e girmemi\u015f, port k\u0131s\u0131tlamas\u0131 olmayan ve IP itibar\u0131 y\u00fcksek bir sunucu \u015fartt\u0131r. E-posta trafi\u011finizin belkemi\u011fini olu\u015fturacak, %100 NVMe SSD performans\u0131na ve kusursuz a\u011f izolasyonuna sahip VDS<\/a> paketlerimizi inceleyerek projenize sa\u011flam bir temel atabilirsiniz.<\/p>\n Sunucuya SSH ile girmeden \u00f6nce DNS y\u00f6neticiniz \u00fczerinden kay\u0131tlar\u0131 a\u00e7\u0131n.<\/p>\n Normal DNS (A kayd\u0131), “Bu alan ad\u0131 hangi IP’ye gidiyor?” sorusunu cevaplar. PTR kayd\u0131 ise kar\u015f\u0131 taraf\u0131n size sordu\u011fu \u015fu sorunun cevab\u0131d\u0131r: “Bu IP adresi kime ait?”<\/strong> E\u011fer Gmail IP’nizi sorgulad\u0131\u011f\u0131nda bo\u015f bir cevap g\u00f6r\u00fcrse, mailinizi direkt reddeder. inetmar.com m\u00fc\u015fteri panelinizde bulunan **Hizmetlerim > IP Adreslerim** b\u00f6l\u00fcm\u00fcnden IP adresinizin PTR kayd\u0131n\u0131 Sunucumuza root olarak ba\u011flan\u0131yoruz. Ubuntu 24.04 LTS \u00fczerinde sistemimizi g\u00fcncelleyip Postfix ve Dovecot yaz\u0131l\u0131mlar\u0131m\u0131z\u0131 kuruyoruz.<\/p>\n Bu kurulumda e-posta imzalama ve spam filtreleme i\u015flemleri i\u00e7in eski nesil yaz\u0131l\u0131mlar yerine modern, C++ tabanl\u0131 ve d\u00fc\u015f\u00fck kaynak t\u00fcketimi sunan Rspamd<\/strong> ve Redis kullanaca\u011f\u0131z:<\/p>\n (Postfix kurulum ekran\u0131 geldi\u011finde “Internet Site” se\u00e7ene\u011fiyle ilerleyin ve Sistem Mail Ad\u0131 olarak Mail kullan\u0131c\u0131lar\u0131 ile sunucu kullan\u0131c\u0131lar\u0131n\u0131 ayn\u0131 tutmak g\u00fcvensiz bir y\u00f6ntemdir. Bunun i\u00e7in t\u00fcm mailleri diskte tutacak yetkisiz tek bir sanal kullan\u0131c\u0131 (vmail) olu\u015fturuyoruz:<\/p>\n E-posta adreslerimizi Sisteme bu dosyay\u0131 okutmak i\u00e7in hash’liyoruz: Maillerin webmail’den okunabilmesi i\u00e7in Dovecot’u yap\u0131land\u0131r\u0131yoruz. Maillerinizin do\u011frudan spame d\u00fc\u015fmemesi i\u00e7in bu kay\u0131tlar\u0131 kusursuz yap\u0131land\u0131rmal\u0131s\u0131n\u0131z.<\/p>\n 1. SPF (Sender Policy Framework):<\/strong> DNS ayarlar\u0131n\u0131z \u00fczerinden TXT kayd\u0131 ekleyin: 2. DKIM \u0130mzalama:<\/strong> Rspamd’ye bu anahtar\u0131 kullanmas\u0131n\u0131 s\u00f6yl\u00fcyoruz. Ard\u0131ndan servisi yeniden ba\u015flat\u0131n: 3. DMARC:<\/strong> G\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 ana sisteme s\u0131\u00e7ratmamak i\u00e7in Webmail aray\u00fcz\u00fcm\u00fcz\u00fc Docker ile kuruyoruz. Bir dizin a\u00e7\u0131n ve Roundcube \u015fu an sadece 8080 portunda \u00e7al\u0131\u015f\u0131yor. Let’s Encrypt ile \u00fccretsiz SSL al\u0131yoruz: Nginx Aktifle\u015ftirip Nas\u0131l ki kritik bir Sanal POS entegrasyonu i\u00e7in sunucunuzda IP izinlerini ince ince ayarlay\u0131p, PowerShell \u00fczerinden ba\u011flant\u0131n\u0131n sa\u011fl\u0131kl\u0131 kuruldu\u011funu milimetrik olarak teyit ediyorsan\u0131z; mail sunucusunda da a\u00e7t\u0131\u011f\u0131n\u0131z her portun tam olarak ne i\u015fe yarad\u0131\u011f\u0131n\u0131 ayn\u0131 ciddiyetle bilmelisiniz.<\/p>\n Sadece gerekli olan IPv4 portlar\u0131n\u0131 a\u00e7\u0131yoruz:<\/p>\n Brute-Force Korumas\u0131:<\/strong> Bunu SRS (Sender Rewriting Scheme)<\/strong> ile \u00e7\u00f6z\u00fcyoruz. Bu ayar sayesinde y\u00f6nlendirilen mailin “G\u00f6nderen” (Envelope Sender) bilgisi sizin alan ad\u0131n\u0131za \u00e7evrilir, kendi SPF’inizden ge\u00e7er ve Gmail’in Inbox’\u0131na sorunsuz d\u00fc\u015fer. Postfix’i yeniden ba\u015flat\u0131n ( Sistemi kurduk, servisler ye\u015fil yan\u0131yor. \u015eimdi do\u011frulama vakti.<\/p>\n Taray\u0131c\u0131n\u0131z\u0131 a\u00e7\u0131n ve Sol \u00fcstten “Olu\u015ftur” butonuna t\u0131klay\u0131n. Ki\u015fisel Gmail adresinize bir test maili g\u00f6nderin. \u0130\u015fte t\u00fcm o eme\u011fin kar\u015f\u0131l\u0131\u011f\u0131n\u0131 burada, Rspamd’nin kusursuz imzalar\u0131yla g\u00f6rece\u011fiz:<\/p>\n Ki\u015fisel Gmail hesab\u0131n\u0131zdan, kendi sunucunuzdaki Ad\u0131mlar\u0131 eksiksiz uygulad\u0131ysan\u0131z, temiz bir IP altyap\u0131s\u0131 \u00fczerinde o muazzam 10\/10<\/strong> skorunu g\u00f6receksiniz!<\/p>\n Kendi mail sunucunuzu kurmak bir vizyon meselesidir. Rspamd gibi yeni nesil ara\u00e7lar\u0131 kullanarak sistemi modern mimariye uygun \u015fekilde in\u015fa etmek, size \u00f6m\u00fcr boyu s\u00fcrecek bir dijital \u00f6zg\u00fcrl\u00fck, y\u00fcksek performans ve e\u015fsiz bir gizlilik sunar.<\/p>\n Do\u011fru konfig\u00fcre edilmi\u015f bir sistem ve g\u00fc\u00e7l\u00fc bir VDS altyap\u0131s\u0131 birle\u015fti\u011finde, ileti\u015fiminiz \u00fczerinde %100 kontrol sahibi oldu\u011funuz, g\u00fcvenilir ve stabil bir yap\u0131ya kavu\u015fursunuz. Kurumsal ileti\u015fiminizin kalbini olu\u015fturacak, a\u011f k\u0131s\u0131tlamalar\u0131ndan uzak, performansl\u0131 VDS Sunucu<\/a> \u00e7\u00f6z\u00fcmlerimizi inceleyerek bu dijital ba\u011f\u0131ms\u0131zl\u0131k yolculu\u011funda en sa\u011flam ad\u0131m\u0131 atabilirsiniz.<\/p>\n","protected":false},"excerpt":{"rendered":" Y\u0131llarca DirectAdmin, cPanel veya Plesk’te birka\u00e7 t\u0131klamayla mail a\u00e7t\u0131k, g\u00f6nderdik, ald\u0131k. Ancak projeleriniz b\u00fcy\u00fcd\u00fck\u00e7e, m\u00fc\u015fteri trafi\u011finiz artt\u0131k\u00e7a ve verinizin gizlili\u011fi \u00f6n plana \u00e7\u0131kt\u0131k\u00e7a o konfor alan\u0131 bir hapishaneye d\u00f6n\u00fc\u015f\u00fcr. “Haz\u0131r hizmetleri (Gmail, Microsoft 365) kullanay\u0131m”...<\/p>\n","protected":false},"author":2,"featured_media":15683,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[55,52,46],"tags":[],"class_list":["post-15678","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-email","category-guvenlik","category-sunucu"],"_links":{"self":[{"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/posts\/15678","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/comments?post=15678"}],"version-history":[{"count":5,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/posts\/15678\/revisions"}],"predecessor-version":[{"id":15685,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/posts\/15678\/revisions\/15685"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/media\/15683"}],"wp:attachment":[{"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/media?parent=15678"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/categories?post=15678"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/www.inetmar.com\/blog\/wp-json\/wp\/v2\/tags?post=15678"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}DNS Kay\u0131tlar\u0131<\/h3>\n
\n
mail.siteniz.com<\/code> -> VDS_IP_Adresi<\/code><\/li>\nsiteniz.com<\/code> -> mail.siteniz.com<\/code> (\u00d6ncelik: 10)<\/li>\n<\/ul>\nPTR (Reverse DNS) Kayd\u0131 Neden Hayatidir?<\/h3>\n
mail.siteniz.com<\/code> olarak mutlaka g\u00fcncelleyin.<\/p>\n![\"\"](\"https:\/\/www.inetmar.com\/blog\/wp-content\/uploads\/2026\/08\/smarthosthizmeti.png\")
<\/p>\nAna Bile\u015fenlerin Kurulumu ve \u0130zolasyon<\/h2>\n
apt update && apt upgrade -y\r\napt install postfix postfix-pcre dovecot-imapd dovecot-lmtpd redis-server rspamd certbot nginx -y<\/code><\/pre>\nsiteniz.com<\/code> girin.)<\/em><\/p>\nSistem Kullan\u0131c\u0131lar\u0131n\u0131 Ay\u0131rmak<\/h3>\n
useradd -m -s \/usr\/sbin\/nologin -G mail vmail\r\nmkdir -p \/home\/vmail\/Mail\/Inbox\r\nchown -R vmail:vmail \/home\/vmail\/Mail<\/code><\/pre>\nPostfix (MTA) ve Dovecot (MDA) Entegrasyonu<\/h2>\n
Postfix<\/h3>\n
\/etc\/postfix\/main.cf<\/code> dosyas\u0131n\u0131 yap\u0131land\u0131r\u0131yoruz. Amac\u0131m\u0131z IPv4 kullan\u0131m\u0131n\u0131 zorunlu k\u0131lmak, d\u0131\u015far\u0131dan gelen SMTP yetkilendirmelerini Dovecot’a devretmek ve \u015fifresiz veri ak\u0131\u015f\u0131n\u0131 yasaklamak. Ayr\u0131ca Postfix’i yeni nesil filtremiz Rspamd’ye ba\u011fl\u0131yoruz.<\/p>\ninet_protocols = ipv4\r\n# \u015eifreler a\u011fda d\u00fcz metin dola\u015fmas\u0131n, TLS zorunlu olsun:\r\nsmtpd_tls_auth_only = yes\r\n\r\n# Yetkilendirmeyi Dovecot yaps\u0131n:\r\nsmtpd_sasl_type = dovecot\r\nsmtpd_sasl_path = private\/auth\r\nsmtpd_sasl_auth_enable = yes\r\n\r\n# Hangi e-posta adresi hangi kullan\u0131c\u0131ya ait haritas\u0131:\r\nvirtual_alias_maps = hash:\/etc\/postfix\/virtual\r\n\r\n# Rspamd (DKIM ve Anti-Spam) Entegrasyonu:\r\nmilter_default_action = accept\r\nmilter_protocol = 6\r\nsmtpd_milters = inet:localhost:11332\r\nnon_smtpd_milters = inet:localhost:11332<\/code><\/pre>\n\/etc\/postfix\/virtual<\/code> dosyas\u0131na tan\u0131ml\u0131yoruz:<\/p>\nadmin@siteniz.com vmail\r\ninfo@siteniz.com vmail<\/code><\/pre>\npostmap \/etc\/postfix\/virtual<\/code><\/p>\nDovecot<\/h3>\n
\/etc\/dovecot\/dovecot.conf<\/code> dosyas\u0131n\u0131 a\u00e7\u0131n:<\/p>\nssl = required\r\n# \u015eifrelerin tutulaca\u011f\u0131 \u00f6zel dosya:\r\npassdb {\r\n driver = passwd-file\r\n args = scheme=CRYPT \/etc\/dovecot\/users\r\n}\r\nuserdb {\r\n driver = passwd-file\r\n args = \/etc\/dovecot\/users\r\n}\r\n# Postfix'in Dovecot \u00fczerinden do\u011frulama yapabilmesi i\u00e7in g\u00fcvenli soket:\r\nservice auth {\r\n unix_listener \/var\/spool\/postfix\/private\/auth {\r\n mode = 0660\r\n user = postfix\r\n group = postfix\r\n }\r\n}<\/code><\/pre>\n\/etc\/dovecot\/users<\/code> dosyas\u0131n\u0131 olu\u015fturun. \u015eifrelerinizi Linux \u00fczerinde doveadm pw -s CRYPT<\/code> komutuyla \u015fifreleyerek bu dosyaya admin@siteniz.com:{CRYPT}$2y$...<\/code> format\u0131nda ekleyin. Dosya izinlerini chmod 644 \/etc\/dovecot\/users<\/code> olarak ayarlay\u0131n.<\/p>\nSPF, Rspamd ile DKIM, DMARC<\/h2>\n
\nv=spf1 mx a:mail.siteniz.com ip4:VDS_IPv4_Adresiniz -all<\/code><\/p>\n
\nSunucumuzda alan ad\u0131m\u0131z i\u00e7in DKIM anahtar\u0131m\u0131z\u0131 \u00fcretiyoruz:<\/p>\nmkdir -p \/var\/lib\/rspamd\/dkim\/\r\nrspamadm dkim_keygen -b 2048 -s mail -k \/var\/lib\/rspamd\/dkim\/mail.private > \/var\/lib\/rspamd\/dkim\/mail.txt\r\nchown -R _rspamd:_rspamd \/var\/lib\/rspamd\/dkim\/\r\nchmod 600 \/var\/lib\/rspamd\/dkim\/mail.private<\/code><\/pre>\n\/etc\/rspamd\/local.d\/dkim_signing.conf<\/code> dosyas\u0131n\u0131 olu\u015fturup i\u00e7ine \u015funu yaz\u0131n:<\/p>\nallow_username_mismatch = true;\r\ndomain {\r\n siteniz.com {\r\n path = \"\/var\/lib\/rspamd\/dkim\/mail.private\";\r\n selector = \"mail\";\r\n }\r\n}<\/code><\/pre>\nsystemctl restart rspamd<\/code>.
\nOlu\u015fturulan \/var\/lib\/rspamd\/dkim\/mail.txt<\/code> dosyas\u0131n\u0131 a\u00e7\u0131n. \u0130\u00e7indeki uzun metni yani anahtar\u0131 DNS ayarlar\u0131n\u0131z\u0131n bulundu\u011fu panelde mail._domainkey<\/code> ad\u0131yla TXT kayd\u0131 olarak ekleyin.<\/p>\n
\nDNS ayarlar\u0131n\u0131za TXT kayd\u0131 olarak _dmarc<\/code> ad\u0131yla \u015funu ekleyin:
\nv=DMARC1; p=quarantine; rua=mailto:admin@siteniz.com; fo=1<\/code><\/p>\nRoundcube & Docker<\/h2>\n
docker-compose.yml<\/code> dosyas\u0131 olu\u015fturun:<\/p>\nservices:\r\n roundcube:\r\n image: roundcube\/roundcubemail:latest-apache\r\n ports:\r\n - \"127.0.0.1:8080:80\"\r\n environment:\r\n - ROUNDCUBEMAIL_DEFAULT_HOST=tls:\/\/VDS_IPv4_Adresiniz\r\n - ROUNDCUBEMAIL_SMTP_SERVER=tls:\/\/VDS_IPv4_Adresiniz<\/code><\/pre>\ndocker compose up -d<\/code> ile aray\u00fcz\u00fc aya\u011fa kald\u0131r\u0131n.<\/p>\nNginx ve SSL Entegrasyonu<\/h3>\n
certbot certonly --standalone -d mail.siteniz.com<\/code><\/p>\n\/etc\/nginx\/sites-available\/mail.siteniz.com<\/code> dosyas\u0131n\u0131 ayarlayarak 443 (HTTPS) \u00fczerinden gelen trafi\u011fi g\u00fcvenli \u015fekilde Docker’a proxy’liyoruz:<\/p>\nserver {\r\n listen 443 ssl;\r\n server_name mail.siteniz.com;\r\n ssl_certificate \/etc\/letsencrypt\/live\/mail.siteniz.com\/fullchain.pem;\r\n ssl_certificate_key \/etc\/letsencrypt\/live\/mail.siteniz.com\/privkey.pem;\r\n\r\n location \/ {\r\n proxy_pass http:\/\/127.0.0.1:8080;\r\n proxy_set_header Host $host;\r\n proxy_set_header X-Real-IP $remote_addr;\r\n }\r\n}<\/code><\/pre>\nsystemctl reload nginx<\/code> komutunu verdi\u011finizde webmail aray\u00fcz\u00fcn\u00fcz yay\u0131ndad\u0131r!<\/p>\nUFW, Fail2ban ve SRS<\/h2>\n
ufw allow 22\/tcp\r\nufw allow 25\/tcp\r\nufw allow 143\/tcp\r\nufw allow 443\/tcp\r\nufw allow 465\/tcp\r\nufw allow 587\/tcp\r\nufw allow 993\/tcp\r\nufw enable<\/code><\/pre>\nsystemctl enable --now fail2ban<\/code> ile servisi etkinle\u015ftirin. Gerekirse \u015fifre deneme yan\u0131lma yapan botlar\u0131 engellemek i\u00e7in postfix filtrelerini aktif edebilirsiniz.<\/p>\nForwarding ve SRS<\/h3>\n
info@siteniz.com<\/code> adresine gelen mailleri ki\u015fisel Gmail’inize y\u00f6nlendirirseniz, orijinal g\u00f6ndericinin SPF kayd\u0131 sizin sunucu IP’nizle e\u015fle\u015fmeyece\u011fi i\u00e7in Gmail maili an\u0131nda reddeder.<\/p>\n
\napt install postsrsd -y<\/code> komutuyla paketi kurun. Postfix main.cf<\/code> dosyas\u0131na \u015fu blo\u011fu ekleyin:<\/p>\n# SRS - Forward edilen mailler i\u00e7in Envelope Rewrite\r\nsender_canonical_maps = tcp:127.0.0.1:10001\r\nsender_canonical_classes = envelope_sender\r\nrecipient_canonical_maps = tcp:127.0.0.1:10002\r\nrecipient_canonical_classes = envelope_recipient,header_recipient<\/code><\/pre>\nsystemctl reload postfix<\/code>).<\/p>\nU\u00e7tan Uca Webmail Testi ve Troubleshooting<\/h2>\n
Webmail Aray\u00fcz\u00fcne Giri\u015f<\/h3>\n
https:\/\/mail.siteniz.com<\/code> adresine gidin.<\/p>\n\n
admin@siteniz.com<\/code> (Domain ile birlikte tam e-posta adresini yazmal\u0131s\u0131n\u0131z).<\/li>\n\u0130lk Maili G\u00f6nderme ve Gmail’de Analiz<\/h3>\n
\nMail Gmail kutunuza d\u00fc\u015ft\u00fc\u011f\u00fcnde, maili a\u00e7\u0131n, sa\u011f \u00fcstteki \u00fc\u00e7 noktaya t\u0131klay\u0131p “Asl\u0131n\u0131 G\u00f6ster” (Show Original)<\/strong> se\u00e7ene\u011fine t\u0131klay\u0131n.<\/p>\n\n
SPF: PASS<\/code> (IP adresiniz siteniz.com ad\u0131na ba\u015far\u0131yla yetkilendirildi)<\/em><\/li>\nDKIM: PASS<\/code> (Rspamd imzan\u0131z do\u011fruland\u0131)<\/em><\/li>\nDMARC: PASS<\/code> (Kurallar\u0131n\u0131z ba\u015far\u0131yla i\u015fletildi)<\/em><\/li>\n<\/ul>\n\u0130\u00e7eriye Mail Alma ve Nihai Skor<\/h3>\n
admin@siteniz.com<\/code> adresinize mail g\u00f6ndererek i\u00e7eriye al\u0131m\u0131 test edin.
\nSonras\u0131nda hatalar\u0131m\u0131z\u0131 g\u00f6rmek i\u00e7in https:\/\/mail-tester.com<\/code> adresine gidin. Verilen ge\u00e7ici adrese Roundcube \u00fczerinden mail g\u00f6nderin.<\/p>\n