{"id":3168,"date":"2026-07-22T06:32:37","date_gmt":"2026-07-22T06:32:37","guid":{"rendered":"https:\/\/hostligo.com\/blog\/?p=3168"},"modified":"2026-07-22T06:32:37","modified_gmt":"2026-07-22T06:32:37","slug":"dns-amplification-nedir-open-resolver-guvenlik-acigi-ve-korunma-yontemleri","status":"publish","type":"post","link":"https:\/\/hostligo.com\/blog\/dns-amplification-nedir-open-resolver-guvenlik-acigi-ve-korunma-yontemleri\/","title":{"rendered":"DNS Amplification Nedir? Open Resolver G\u00fcvenlik A\u00e7\u0131\u011f\u0131 ve Korunma Y\u00f6ntemleri"},"content":{"rendered":"

DNS Amplification (DNS Y\u00fckseltme) Sald\u0131r\u0131s\u0131 Nedir? Nas\u0131l \u00d6nlenir?<\/h1>\n

\u0130nternet altyap\u0131s\u0131nda en s\u0131k kar\u015f\u0131la\u015f\u0131lan DDoS sald\u0131r\u0131lar\u0131ndan<\/strong> biri olan
\nDNS Amplification (DNS Y\u00fckseltme) sald\u0131r\u0131s\u0131<\/strong>, yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f DNS sunucular\u0131n\u0131 kullanarak
\nhedef sistemlere \u00e7ok y\u00fcksek miktarda trafik g\u00f6nderilmesini ama\u00e7lar.
\nSald\u0131rganlar do\u011frudan hedefe sald\u0131rmak yerine, internette bulunan
\nOpen Resolver (A\u00e7\u0131k DNS \u00c7\u00f6z\u00fcc\u00fcler)<\/strong> \u00fczerinden sald\u0131r\u0131y\u0131 b\u00fcy\u00fcterek
\n\u00e7ok daha etkili hale getirir.<\/p>\n

\u00d6zellikle VPS<\/strong>, Dedicated Server<\/strong> ve
\nKurumsal DNS Sunucular\u0131<\/strong> y\u00f6neten sistem y\u00f6neticilerinin
\nDNS yap\u0131land\u0131rmalar\u0131n\u0131 do\u011fru \u015fekilde yapmalar\u0131 b\u00fcy\u00fck \u00f6nem ta\u015f\u0131maktad\u0131r.<\/p>\n

\n

DNS Amplification Sald\u0131r\u0131s\u0131 Nas\u0131l \u00c7al\u0131\u015f\u0131r?<\/h2>\n

Bir DNS Amplification sald\u0131r\u0131s\u0131nda ama\u00e7, k\u00fc\u00e7\u00fck boyutlu bir iste\u011fi
\n\u00e7ok daha b\u00fcy\u00fck cevaplara d\u00f6n\u00fc\u015ft\u00fcrerek hedef sistemi yo\u011fun trafik alt\u0131nda b\u0131rakmakt\u0131r.<\/p>\n

1. A\u00e7\u0131k DNS Sunucular\u0131 Bulunur<\/h3>\n

Sald\u0131rganlar internet \u00fczerinde Recursion<\/strong> \u00f6zelli\u011fi herkese a\u00e7\u0131k olan
\nDNS sunucular\u0131n\u0131 tarar. Bu sunucular sald\u0131r\u0131n\u0131n temel kayna\u011f\u0131n\u0131 olu\u015fturur.<\/p>\n

2. Sahte IP Adresi Kullan\u0131l\u0131r<\/h3>\n

G\u00f6nderilen DNS sorgular\u0131nda sald\u0131rgan kendi IP adresi yerine
\nhedef sunucunun IP adresini kullan\u0131r.
\nBu y\u00f6ntem IP Spoofing<\/strong> olarak adland\u0131r\u0131l\u0131r.<\/p>\n

3. B\u00fcy\u00fck DNS Yan\u0131tlar\u0131 Olu\u015fturulur<\/h3>\n

DNS sunucusu iste\u011fin sahte oldu\u011funu anlayamaz ve
\nolu\u015fturdu\u011fu b\u00fcy\u00fck DNS cevaplar\u0131n\u0131 do\u011frudan hedef sunucuya g\u00f6nderir.
\nB\u00f6ylece birka\u00e7 baytl\u0131k istek onlarca kat daha b\u00fcy\u00fck veri paketlerine d\u00f6n\u00fc\u015f\u00fcr.<\/p>\n

4. Hedef Sunucu Trafik Alt\u0131nda Kal\u0131r<\/h3>\n

Binlerce DNS sunucusundan gelen yo\u011fun trafik,
\nhedef sistemin internet hatt\u0131n\u0131 tamamen doldurabilir.
\nSonu\u00e7 olarak web sitesi, API servisleri ve di\u011fer a\u011f servisleri eri\u015filemez hale gelir.<\/p>\n

\n

DNS Amplification Sald\u0131r\u0131s\u0131n\u0131n Zararlar\u0131<\/h2>\n
    \n
  • Bant geni\u015fli\u011finin tamamen dolmas\u0131na<\/strong> neden olur.<\/li>\n
  • Web sitesi ve uygulamalar eri\u015filemez hale gelir.<\/strong><\/li>\n
  • Mail sunucular\u0131<\/strong> ve di\u011fer servisler etkilenebilir.<\/li>\n
  • Sunucu kaynaklar\u0131 t\u00fckenir.<\/strong><\/li>\n
  • Veri merkezi a\u011f\u0131nda zincirleme kesintiler ya\u015fanabilir.<\/strong><\/li>\n<\/ul>\n
    \n

    DNS Amplification Sald\u0131r\u0131s\u0131ndan Nas\u0131l Korunulur?<\/h2>\n

    En etkili y\u00f6ntemlerden biri,
    \nDNS Recursion<\/strong> \u00f6zelli\u011fini yaln\u0131zca g\u00fcvenilen istemcilere a\u00e7\u0131k b\u0131rakmakt\u0131r.
    \nE\u011fer DNS sunucunuz herkese recursion hizmeti veriyorsa,
    \nsunucunuz sald\u0131rganlar taraf\u0131ndan kullan\u0131labilir.<\/p>\n

    \n

    Windows Server’da DNS Recursion Kapatma<\/h2>\n

    1. DNS Manager’\u0131 A\u00e7\u0131n<\/h3>\n

    Windows Ba\u015flat men\u00fcs\u00fcnden DNS Manager<\/strong> uygulamas\u0131n\u0131 \u00e7al\u0131\u015ft\u0131r\u0131n.<\/p>\n

    2. Sunucu \u00d6zelliklerine Girin<\/h3>\n

    DNS sunucunuza sa\u011f t\u0131klay\u0131n ve
    \nProperties<\/strong> men\u00fcs\u00fcn\u00fc a\u00e7\u0131n.<\/p>\n

    3. Advanced Sekmesini A\u00e7\u0131n<\/h3>\n

    Disable recursion (also disables forwarders)<\/strong>
    \nkutucu\u011funu i\u015faretleyerek Recursion \u00f6zelli\u011fini kapat\u0131n.<\/p>\n

    4. DNS Servisini Yeniden Ba\u015flat\u0131n<\/h3>\n

    Yap\u0131lan de\u011fi\u015fikliklerin aktif olmas\u0131 i\u00e7in DNS servisini yeniden ba\u015flat\u0131n.<\/p>\n

    \n

    Linux (BIND DNS) Sunucusunda Recursion Kapatma<\/h2>\n

    1. Sunucuya SSH ile Ba\u011flan\u0131n<\/h3>\n

    Root kullan\u0131c\u0131s\u0131 ile sunucuya giri\u015f yap\u0131n.<\/p>\n

    2. BIND Yap\u0131land\u0131rmas\u0131n\u0131 A\u00e7\u0131n<\/h3>\n
    nano \/etc\/named.conf<\/code><\/pre>\n
    3. Recursion Parametresini D\u00fczenleyin<\/h3>\n
    Dosya i\u00e7erisinde
    \nCTRL + W<\/code>
    \ntu\u015flar\u0131na basarak
    \nrecursion<\/code>
    \nkelimesini arat\u0131n.<\/p>\n
    E\u011fer a\u015fa\u011f\u0131daki sat\u0131r\u0131 g\u00f6r\u00fcyorsan\u0131z;<\/p>\n
    recursion yes;<\/code><\/pre>\n
    \u015eu \u015fekilde de\u011fi\u015ftirin:<\/p>\n
    recursion no;<\/code><\/pre>\n
    4. Dosyay\u0131 Kaydedin<\/h3>\n
    Kaydetmek i\u00e7in s\u0131ras\u0131yla;<\/p>\n
    CTRL + X<\/code><\/p>\n
    ard\u0131ndan<\/p>\n
    Y<\/code><\/p>\n
    ve son olarak<\/p>\n
    ENTER<\/code><\/p>\n
    tu\u015flar\u0131na bas\u0131n.<\/p>\n
    5. DNS Servisini Yeniden Ba\u015flat\u0131n<\/h3>\n
    service named restart<\/code><\/pre>\n
    \n
    Recursion Kapat\u0131ld\u0131\u011f\u0131n\u0131 Nas\u0131l Kontrol Edebilirsiniz?<\/h2>\n
    Y\u00f6ntem 1 – nslookup ile Test<\/h3>\n
    Windows Komut \u0130stemi \u00fczerinden a\u015fa\u011f\u0131daki komutu \u00e7al\u0131\u015ft\u0131r\u0131n:<\/p>\n
    nslookup -q=a example.com 1.1.1.1<\/code><\/pre>\n
    G\u00fcvenli Sonu\u00e7<\/strong><\/p>\n
    Query refused<\/code><\/p>\n
    veya benzeri bir hata al\u0131yorsan\u0131z,
    \nRecursion ba\u015far\u0131yla kapat\u0131lm\u0131\u015ft\u0131r.<\/p>\n
    Riskli Sonu\u00e7<\/strong><\/p>\n
    Alan ad\u0131na ait IP adresi d\u00f6nd\u00fcr\u00fcl\u00fcyorsa,
    \nDNS sunucunuz halen d\u0131\u015f d\u00fcnyaya Recursion hizmeti vermektedir.<\/p>\n
    \n
    Y\u00f6ntem 2 – Online Kontrol<\/h3>\n
    Alan ad\u0131n\u0131z\u0131 IntoDNS<\/strong> gibi DNS analiz servislerinde sorgulayarak
    \nOpen Resolver<\/strong> durumunu kontrol edebilirsiniz.
    \nBu ara\u00e7lar yanl\u0131\u015f DNS yap\u0131land\u0131rmalar\u0131n\u0131 ve g\u00fcvenlik a\u00e7\u0131klar\u0131n\u0131 tespit etmenize yard\u0131mc\u0131 olur.<\/p>\n
    \n
    \u26a0\ufe0f HostLigo G\u00fcvenlik \u00d6nerisi<\/strong><\/p>\n
    DNS Recursion \u00f6zelli\u011fini internet \u00fczerindeki t\u00fcm istemcilere a\u00e7\u0131k b\u0131rakmak,
    \nsunucunuzun istemeden bir DNS Amplification sald\u0131r\u0131s\u0131nda<\/strong>
    \nkullan\u0131lmas\u0131na neden olabilir.<\/p>\n
    Kurumsal sunucularda Recursion \u00f6zelli\u011fi yaln\u0131zca
    \nlocalhost<\/strong> veya
    \ng\u00fcvenilir i\u00e7 a\u011f istemcileri<\/strong> ile s\u0131n\u0131rland\u0131r\u0131lmal\u0131d\u0131r.<\/p>\n
    Bu sayede hem sunucu g\u00fcvenli\u011fi art\u0131r\u0131l\u0131r hem de olas\u0131 DDoS sald\u0131r\u0131lar\u0131nda
    \naltyap\u0131n\u0131z\u0131n k\u00f6t\u00fcye kullan\u0131lmas\u0131n\u0131n \u00f6n\u00fcne ge\u00e7ilmi\u015f olur.<\/p>\n<\/div>\n
    \n
    Sonu\u00e7<\/h2>\n
    DNS Amplification sald\u0131r\u0131lar\u0131<\/strong>, yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f DNS sunucular\u0131n\u0131 hedef alan
    \nen etkili DDoS y\u00f6ntemlerinden biridir.
    \nSunucunuzda gereksiz Recursion eri\u015fimini kapatarak,
    \nhem kendi altyap\u0131n\u0131z\u0131 koruyabilir hem de internet \u00fczerindeki sald\u0131r\u0131 zincirlerinin bir par\u00e7as\u0131 olman\u0131z\u0131 engelleyebilirsiniz.<\/p>\n
    HostLigo olarak t\u00fcm DNS sunucular\u0131nda g\u00fcvenlik ayarlar\u0131n\u0131n d\u00fczenli olarak kontrol edilmesini ve yaln\u0131zca ihtiya\u00e7 duyulan servislerin a\u00e7\u0131k b\u0131rak\u0131lmas\u0131n\u0131 \u00f6neriyoruz.<\/p>\n","protected":false},"excerpt":{"rendered":"
    DNS Amplification (DNS Y\u00fckseltme) Sald\u0131r\u0131s\u0131 Nedir? Nas\u0131l \u00d6nlenir? \u0130nternet altyap\u0131s\u0131nda en s\u0131k kar\u015f\u0131la\u015f\u0131lan DDoS sald\u0131r\u0131lar\u0131ndan biri olan DNS Amplification (DNS Y\u00fckseltme) sald\u0131r\u0131s\u0131, yanl\u0131\u015f yap\u0131land\u0131r\u0131lm\u0131\u015f DNS sunucular\u0131n\u0131 kullanarak hedef sistemlere \u00e7ok y\u00fcksek miktarda trafik g\u00f6nderilmesini ama\u00e7lar. Sald\u0131rganlar do\u011frudan hedefe sald\u0131rmak yerine, internette bulunan Open Resolver (A\u00e7\u0131k DNS \u00c7\u00f6z\u00fcc\u00fcler) \u00fczerinden sald\u0131r\u0131y\u0131 b\u00fcy\u00fcterek \u00e7ok daha etkili hale getirir. […]<\/p>\n","protected":false},"author":2,"featured_media":0,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"pagelayer_contact_templates":[],"_pagelayer_content":"","footnotes":""},"categories":[238,235,237],"tags":[436,431,432,375,427,428,447,430,442,443,434,440,441,429,446,438,445,439,433,435,167,343,444,437,366],"class_list":["post-3168","post","type-post","status-publish","format-standard","hentry","category-linux","category-sunucu-yonetimi","category-windows","tag-bind-dns","tag-ddos","tag-ddos-saldirisi","tag-dedicated-server","tag-dns-amplification","tag-dns-amplification-saldirisi","tag-dns-ayarlari","tag-dns-guvenligi","tag-dns-guvenlik-acigi","tag-dns-korumasi","tag-dns-recursion","tag-dns-server","tag-dns-yapilandirma","tag-dns-yukseltme-saldirisi","tag-hostligo","tag-linux-dns","tag-linux-sunucu","tag-named-conf","tag-open-resolver","tag-recursion-kapatma","tag-siber-guvenlik","tag-sunucu-guvenligi","tag-vps-guvenligi","tag-windows-dns","tag-windows-server"],"_links":{"self":[{"href":"https:\/\/hostligo.com\/blog\/wp-json\/wp\/v2\/posts\/3168","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/hostligo.com\/blog\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/hostligo.com\/blog\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/hostligo.com\/blog\/wp-json\/wp\/v2\/users\/2"}],"replies":[{"embeddable":true,"href":"https:\/\/hostligo.com\/blog\/wp-json\/wp\/v2\/comments?post=3168"}],"version-history":[{"count":1,"href":"https:\/\/hostligo.com\/blog\/wp-json\/wp\/v2\/posts\/3168\/revisions"}],"predecessor-version":[{"id":3170,"href":"https:\/\/hostligo.com\/blog\/wp-json\/wp\/v2\/posts\/3168\/revisions\/3170"}],"wp:attachment":[{"href":"https:\/\/hostligo.com\/blog\/wp-json\/wp\/v2\/media?parent=3168"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/hostligo.com\/blog\/wp-json\/wp\/v2\/categories?post=3168"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/hostligo.com\/blog\/wp-json\/wp\/v2\/tags?post=3168"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}