From: Alessio Podda <alessio@isc.org>
Date: Fri, 20 Mar 2026 08:25:23 +0000 (+0100)
Subject: Save progress?
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=07f5dec846f5c334c1b044c0912b710a366ac8e8;p=thirdparty%2Fbind9.git

Save progress?
---

diff --git a/bin/check/named-checkconf.c b/bin/check/named-checkconf.c
index a40a4b703c5..1b7d4eb0fdf 100644
--- a/bin/check/named-checkconf.c
+++ b/bin/check/named-checkconf.c
@@ -38,6 +38,7 @@
 #include <dns/rootns.h>
 #include <dns/zone.h>
 
+#include <isccfg/clause.h>
 #include <isccfg/check.h>
 #include <isccfg/grammar.h>
 #include <isccfg/namedconf.h>
@@ -83,7 +84,7 @@ get_checknames(const cfg_obj_t **maps, const cfg_obj_t **obj) {
 			return false;
 		}
 		checknames = NULL;
-		result = cfg_map_get(maps[i], "check-names", &checknames);
+		result = cfg_map_get(maps[i], CFG_CLAUSE_CHECK_NAMES, &checknames);
 		if (result != ISC_R_SUCCESS) {
 			continue;
 		}
@@ -164,14 +165,14 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		maps[i++] = cfg_tuple_get(vconfig, "options");
 	}
 	if (config != NULL) {
-		cfg_map_get(config, "options", &obj);
+		cfg_map_get(config, CFG_CLAUSE_OPTIONS, &obj);
 		if (obj != NULL) {
 			maps[i++] = obj;
 		}
 	}
 	maps[i] = NULL;
 
-	cfg_map_get(zoptions, "in-view", &inviewobj);
+	cfg_map_get(zoptions, CFG_CLAUSE_IN_VIEW, &inviewobj);
 	if (inviewobj != NULL && list) {
 		const char *inview = cfg_obj_asstring(inviewobj);
 		printf("%s %s %s in-view %s\n", zname, zclass, view, inview);
@@ -180,7 +181,7 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 		return ISC_R_SUCCESS;
 	}
 
-	cfg_map_get(zoptions, "type", &typeobj);
+	cfg_map_get(zoptions, CFG_CLAUSE_TYPE, &typeobj);
 	if (typeobj == NULL) {
 		return ISC_R_FAILURE;
 	}
@@ -194,19 +195,19 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 	/*
 	 * Skip checks when using an alternate data source.
 	 */
-	cfg_map_get(zoptions, "database", &dbobj);
+	cfg_map_get(zoptions, CFG_CLAUSE_DATABASE, &dbobj);
 	if (dbobj != NULL &&
 	    strcmp(ZONEDB_DEFAULT, cfg_obj_asstring(dbobj)) != 0)
 	{
 		return ISC_R_SUCCESS;
 	}
 
-	cfg_map_get(zoptions, "dlz", &dlzobj);
+	cfg_map_get(zoptions, CFG_CLAUSE_DLZ, &dlzobj);
 	if (dlzobj != NULL) {
 		return ISC_R_SUCCESS;
 	}
 
-	cfg_map_get(zoptions, "file", &fileobj);
+	cfg_map_get(zoptions, CFG_CLAUSE_FILE, &fileobj);
 	if (fileobj != NULL) {
 		zfile = cfg_obj_asstring(fileobj);
 	}
@@ -229,9 +230,9 @@ configure_zone(const char *vclass, const char *view, const cfg_obj_t *zconfig,
 	 * Is the redirect zone configured as a secondary?
 	 */
 	if (strcasecmp(cfg_obj_asstring(typeobj), "redirect") == 0) {
-		cfg_map_get(zoptions, "primaries", &primariesobj);
+		cfg_map_get(zoptions, CFG_CLAUSE_PRIMARIES, &primariesobj);
 		if (primariesobj == NULL) {
-			cfg_map_get(zoptions, "masters", &primariesobj);
+			cfg_map_get(zoptions, CFG_CLAUSE_MASTERS, &primariesobj);
 		}
 
 		if (primariesobj != NULL) {
@@ -437,9 +438,9 @@ configure_view(const char *vclass, const char *view, const cfg_obj_t *config,
 
 	zonelist = NULL;
 	if (voptions != NULL) {
-		(void)cfg_map_get(voptions, "zone", &zonelist);
+		(void)cfg_map_get(voptions, CFG_CLAUSE_ZONE, &zonelist);
 	} else {
-		(void)cfg_map_get(config, "zone", &zonelist);
+		(void)cfg_map_get(config, CFG_CLAUSE_ZONE, &zonelist);
 	}
 
 	CFG_LIST_FOREACH(zonelist, element) {
@@ -477,7 +478,7 @@ load_zones_fromconfig(const cfg_obj_t *config, bool list_zones) {
 
 	views = NULL;
 
-	(void)cfg_map_get(config, "view", &views);
+	(void)cfg_map_get(config, CFG_CLAUSE_VIEW, &views);
 	CFG_LIST_FOREACH(views, element) {
 		const cfg_obj_t *classobj;
 		dns_rdataclass_t viewclass;
diff --git a/bin/delv/delv.c b/bin/delv/delv.c
index c149eedaf4a..aed9d381a67 100644
--- a/bin/delv/delv.c
+++ b/bin/delv/delv.c
@@ -75,6 +75,7 @@
 
 #include <dst/dst.h>
 
+#include <isccfg/clause.h>
 #include <isccfg/grammar.h>
 #include <isccfg/namedconf.h>
 
@@ -155,10 +156,10 @@ static dns_fixedname_t qfn;
 /* Default trust anchors and clause/type definitions */
 static char anchortext[] = TRUST_ANCHORS;
 
-static cfg_clausedef_t delv_clauses[] = { { "builtin-trust-anchors",
+static cfg_clausedef_t delv_clauses[] = { { CFG_CLAUSE_BUILTIN_TRUST_ANCHORS,
 					    &cfg_type_builtin_dnsseckeys,
 					    CFG_CLAUSEFLAG_MULTI, NULL },
-					  { NULL, NULL, 0, NULL } };
+					  { CFG_CLAUSE__NONE, NULL, 0, NULL } };
 static cfg_clausedef_t *delv_clausesets[] = { delv_clauses, NULL };
 static cfg_type_t delv_type = { "delv", cfg_parse_mapbody, NULL,
 				NULL,	&cfg_rep_map,	   delv_clausesets };
@@ -836,7 +837,7 @@ setup_dnsseckeys(dns_client_t *client, dns_view_t *toview) {
 		}
 
 		INSIST(bindkeys != NULL);
-		cfg_map_get(bindkeys, "trust-anchors", &trust_anchors);
+		cfg_map_get(bindkeys, CFG_CLAUSE_TRUST_ANCHORS, &trust_anchors);
 	} else {
 		isc_buffer_t b;
 
@@ -848,7 +849,7 @@ setup_dnsseckeys(dns_client_t *client, dns_view_t *toview) {
 			fatal("Unable to parse built-in keys");
 		}
 		INSIST(bindkeys != NULL);
-		cfg_map_get(bindkeys, "builtin-trust-anchors", &trust_anchors);
+		cfg_map_get(bindkeys, CFG_CLAUSE_BUILTIN_TRUST_ANCHORS, &trust_anchors);
 	}
 
 	if (trust_anchors != NULL) {
diff --git a/bin/dig/dighost.c b/bin/dig/dighost.c
index 4c0af64d64b..49d38c01d88 100644
--- a/bin/dig/dighost.c
+++ b/bin/dig/dighost.c
@@ -77,6 +77,7 @@
 
 #include <dst/dst.h>
 
+#include <isccfg/clause.h>
 #include <isccfg/namedconf.h>
 
 #include <irs/resconf.h>
@@ -1064,10 +1065,10 @@ read_confkey(void) {
 
 	CHECK(cfg_parse_file(keyfile, &cfg_type_sessionkey, 0, &file));
 
-	CHECK(cfg_map_get(file, "key", &keyobj));
+	CHECK(cfg_map_get(file, CFG_CLAUSE_KEY, &keyobj));
 
-	(void)cfg_map_get(keyobj, "secret", &secretobj);
-	(void)cfg_map_get(keyobj, "algorithm", &algorithmobj);
+	(void)cfg_map_get(keyobj, CFG_CLAUSE_SECRET, &secretobj);
+	(void)cfg_map_get(keyobj, CFG_CLAUSE_ALGORITHM, &algorithmobj);
 	if (secretobj == NULL || algorithmobj == NULL) {
 		fatal("key must have algorithm and secret");
 	}
diff --git a/bin/dnssec/dnssectool.c b/bin/dnssec/dnssectool.c
index 31cfe8ec079..6cd14a1714c 100644
--- a/bin/dnssec/dnssectool.c
+++ b/bin/dnssec/dnssectool.c
@@ -53,6 +53,7 @@
 #include <dns/rdatatype.h>
 #include <dns/secalg.h>
 #include <dns/time.h>
+#include <isccfg/clause.h>
 
 #include "dnssectool.h"
 
@@ -618,7 +619,7 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 	ISC_LIST_INIT(kasplist);
 	ISC_LIST_INIT(kslist);
 
-	(void)cfg_map_get(config, "key-store", &keystores);
+	(void)cfg_map_get(config, CFG_CLAUSE_KEY_STORE, &keystores);
 	CFG_LIST_FOREACH(keystores, element) {
 		cfg_obj_t *kconfig = cfg_listelt_value(element);
 		result = cfg_keystore_fromconfig(kconfig, mctx, &kslist, NULL);
@@ -637,7 +638,7 @@ kasp_from_conf(cfg_obj_t *config, isc_mem_t *mctx, const char *name,
 	}
 	dns_keystore_detach(&keystore);
 
-	(void)cfg_map_get(config, "dnssec-policy", &kasps);
+	(void)cfg_map_get(config, CFG_CLAUSE_DNSSEC_POLICY, &kasps);
 	CFG_LIST_FOREACH(kasps, element) {
 		dns_kasp_t *kasp = NULL;
 
diff --git a/bin/named/config.c b/bin/named/config.c
index a4753671091..66e9825f7a3 100644
--- a/bin/named/config.c
+++ b/bin/named/config.c
@@ -41,6 +41,7 @@
 
 #include <dst/dst.h>
 
+#include <isccfg/clause.h>
 #include <isccfg/check.h>
 #include <isccfg/grammar.h>
 #include <isccfg/namedconf.h>
@@ -138,7 +139,7 @@ named_checknames_get(const cfg_obj_t **maps, const char *const names[],
 
 	for (i = 0; maps[i] != NULL; i++) {
 		checknames = NULL;
-		if (cfg_map_get(maps[i], "check-names", &checknames) ==
+		if (cfg_map_get(maps[i], CFG_CLAUSE_CHECK_NAMES, &checknames) ==
 		    ISC_R_SUCCESS)
 		{
 			/*
@@ -645,7 +646,7 @@ named_config_getport(const cfg_obj_t *config, const char *type,
 	isc_result_t result;
 	int i;
 
-	(void)cfg_map_get(config, "options", &options);
+	(void)cfg_map_get(config, CFG_CLAUSE_OPTIONS, &options);
 	i = 0;
 	if (options != NULL) {
 		maps[i++] = options;
diff --git a/bin/named/controlconf.c b/bin/named/controlconf.c
index 048b88f0872..54da8856cdb 100644
--- a/bin/named/controlconf.c
+++ b/bin/named/controlconf.c
@@ -40,6 +40,7 @@
 #include <isccc/sexpr.h>
 #include <isccc/util.h>
 
+#include <isccfg/clause.h>
 #include <isccfg/check.h>
 #include <isccfg/namedconf.h>
 
@@ -722,8 +723,8 @@ register_keys(const cfg_obj_t *control, const cfg_obj_t *keylist,
 			const char *secretstr = NULL;
 			unsigned int algtype;
 
-			(void)cfg_map_get(keydef, "algorithm", &algobj);
-			(void)cfg_map_get(keydef, "secret", &secretobj);
+			(void)cfg_map_get(keydef, CFG_CLAUSE_ALGORITHM, &algobj);
+			(void)cfg_map_get(keydef, CFG_CLAUSE_SECRET, &secretobj);
 			INSIST(algobj != NULL && secretobj != NULL);
 
 			algstr = cfg_obj_asstring(algobj);
@@ -788,7 +789,7 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 	}
 
 	CHECK(cfg_parse_file(named_g_keyfile, &cfg_type_rndckey, 0, &config));
-	CHECK(cfg_map_get(config, "key", &key));
+	CHECK(cfg_map_get(config, CFG_CLAUSE_KEY, &key));
 
 	keyid = isc_mem_get(mctx, sizeof(*keyid));
 	*keyid = (controlkey_t){
@@ -800,8 +801,8 @@ get_rndckey(isc_mem_t *mctx, controlkeylist_t *keyids) {
 
 	CHECK(isccfg_check_key(key));
 
-	(void)cfg_map_get(key, "algorithm", &algobj);
-	(void)cfg_map_get(key, "secret", &secretobj);
+	(void)cfg_map_get(key, CFG_CLAUSE_ALGORITHM, &algobj);
+	(void)cfg_map_get(key, CFG_CLAUSE_SECRET, &secretobj);
 	INSIST(algobj != NULL && secretobj != NULL);
 
 	algstr = cfg_obj_asstring(algobj);
@@ -865,7 +866,7 @@ get_key_info(const cfg_obj_t *config, const cfg_obj_t *control,
 	if (!cfg_obj_isvoid(control_keylist) &&
 	    cfg_list_first(control_keylist) != NULL)
 	{
-		result = cfg_map_get(config, "key", &global_keylist);
+		result = cfg_map_get(config, CFG_CLAUSE_KEY, &global_keylist);
 
 		if (result == ISC_R_SUCCESS) {
 			*global_keylistp = global_keylist;
@@ -1121,7 +1122,7 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 	/*
 	 * Get the list of named.conf 'controls' statements.
 	 */
-	(void)cfg_map_get(config, "controls", &controlslist);
+	(void)cfg_map_get(config, CFG_CLAUSE_CONTROLS, &controlslist);
 
 	/*
 	 * Run through the new control channel list, noting sockets that
@@ -1139,7 +1140,7 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 
 			controls = cfg_listelt_value(element);
 
-			(void)cfg_map_get(controls, "unix", &unixcontrols);
+			(void)cfg_map_get(controls, CFG_CLAUSE_UNIX, &unixcontrols);
 			if (unixcontrols != NULL) {
 				cfg_obj_log(controls, ISC_LOG_ERROR,
 					    "UNIX domain sockets are not "
@@ -1147,7 +1148,7 @@ named_controls_configure(named_controls_t *cp, const cfg_obj_t *config,
 				return ISC_R_FAILURE;
 			}
 
-			(void)cfg_map_get(controls, "inet", &inetcontrols);
+			(void)cfg_map_get(controls, CFG_CLAUSE_INET, &inetcontrols);
 			if (inetcontrols == NULL) {
 				continue;
 			}
diff --git a/bin/named/logconf.c b/bin/named/logconf.c
index b1e8cdc7f97..5f59603a592 100644
--- a/bin/named/logconf.c
+++ b/bin/named/logconf.c
@@ -23,6 +23,7 @@
 #include <isc/syslog.h>
 #include <isc/util.h>
 
+#include <isccfg/clause.h>
 #include <isccfg/cfg.h>
 
 #include <named/log.h>
@@ -93,10 +94,10 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 
 	channelname = cfg_obj_asstring(cfg_map_getname(channel));
 
-	(void)cfg_map_get(channel, "file", &fileobj);
-	(void)cfg_map_get(channel, "syslog", &syslogobj);
-	(void)cfg_map_get(channel, "null", &nullobj);
-	(void)cfg_map_get(channel, "stderr", &stderrobj);
+	(void)cfg_map_get(channel, CFG_CLAUSE_FILE, &fileobj);
+	(void)cfg_map_get(channel, CFG_CLAUSE_SYSLOG, &syslogobj);
+	(void)cfg_map_get(channel, CFG_CLAUSE_NULL, &nullobj);
+	(void)cfg_map_get(channel, CFG_CLAUSE_STDERR, &stderrobj);
 
 	i = 0;
 	if (fileobj != NULL) {
@@ -204,10 +205,10 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 		const cfg_obj_t *printtime = NULL;
 		const cfg_obj_t *buffered = NULL;
 
-		(void)cfg_map_get(channel, "print-category", &printcat);
-		(void)cfg_map_get(channel, "print-severity", &printsev);
-		(void)cfg_map_get(channel, "print-time", &printtime);
-		(void)cfg_map_get(channel, "buffered", &buffered);
+		(void)cfg_map_get(channel, CFG_CLAUSE_PRINT_CATEGORY, &printcat);
+		(void)cfg_map_get(channel, CFG_CLAUSE_PRINT_SEVERITY, &printsev);
+		(void)cfg_map_get(channel, CFG_CLAUSE_PRINT_TIME, &printtime);
+		(void)cfg_map_get(channel, CFG_CLAUSE_BUFFERED, &buffered);
 
 		if (printcat != NULL && cfg_obj_asboolean(printcat)) {
 			flags |= ISC_LOG_PRINTCATEGORY;
@@ -236,7 +237,7 @@ channel_fromconf(const cfg_obj_t *channel, isc_logconfig_t *logconfig) {
 	}
 
 	level = ISC_LOG_INFO;
-	if (cfg_map_get(channel, "severity", &severity) == ISC_R_SUCCESS) {
+	if (cfg_map_get(channel, CFG_CLAUSE_SEVERITY, &severity) == ISC_R_SUCCESS) {
 		if (cfg_obj_isstring(severity)) {
 			const char *str = cfg_obj_asstring(severity);
 			if (strcasecmp(str, "critical") == 0) {
@@ -315,13 +316,13 @@ named_logconfig(isc_logconfig_t *logconfig, const cfg_obj_t *logstmt) {
 		named_log_setdefaultsslkeylogfile(logconfig);
 	}
 
-	(void)cfg_map_get(logstmt, "channel", &channels);
+	(void)cfg_map_get(logstmt, CFG_CLAUSE_CHANNEL, &channels);
 	CFG_LIST_FOREACH(channels, element) {
 		const cfg_obj_t *channel = cfg_listelt_value(element);
 		CHECK(channel_fromconf(channel, logconfig));
 	}
 
-	(void)cfg_map_get(logstmt, "category", &categories);
+	(void)cfg_map_get(logstmt, CFG_CLAUSE_CATEGORY, &categories);
 	CFG_LIST_FOREACH(categories, element) {
 		const cfg_obj_t *category = cfg_listelt_value(element);
 		CHECK(category_fromconf(category, logconfig));
diff --git a/bin/named/nzd.c b/bin/named/nzd.c
index f3707e497ea..3c7943969c7 100644
--- a/bin/named/nzd.c
+++ b/bin/named/nzd.c
@@ -19,6 +19,7 @@
 #include <dns/name.h>
 #include <dns/zone.h>
 
+#include <isccfg/clause.h>
 #include <isccfg/cfg.h>
 #include <isccfg/namedconf.h>
 
@@ -391,7 +392,7 @@ nzd_load_nzf(dns_view_t *view) {
 	}
 
 	zonelist = NULL;
-	CHECK(cfg_map_get(nzf_config, "zone", &zonelist));
+	CHECK(cfg_map_get(nzf_config, CFG_CLAUSE_ZONE, &zonelist));
 	if (!cfg_obj_islist(zonelist)) {
 		CLEANUP(ISC_R_FAILURE);
 	}
diff --git a/bin/named/server.c b/bin/named/server.c
index 78176773b2e..36a9d4553b7 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -105,6 +105,7 @@
 
 #include <dst/dst.h>
 
+#include <isccfg/clause.h>
 #include <isccfg/check.h>
 #include <isccfg/grammar.h>
 #include <isccfg/kaspconf.h>
@@ -506,7 +507,7 @@ configure_view_acl(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 	}
 	if (config != NULL) {
 		const cfg_obj_t *options = NULL;
-		(void)cfg_map_get(config, "options", &options);
+		(void)cfg_map_get(config, CFG_CLAUSE_OPTIONS, &options);
 		if (options != NULL) {
 			maps[i++] = options;
 		}
@@ -559,7 +560,7 @@ configure_view_nametable(const cfg_obj_t *vconfig, const cfg_obj_t *config,
 	}
 	if (config != NULL) {
 		const cfg_obj_t *options = NULL;
-		(void)cfg_map_get(config, "options", &options);
+		(void)cfg_map_get(config, CFG_CLAUSE_OPTIONS, &options);
 		if (options != NULL) {
 			maps[i++] = options;
 		}
@@ -1034,16 +1035,16 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 	if (vconfig != NULL) {
 		voptions = cfg_tuple_get(vconfig, "options");
 		if (voptions != NULL) {
-			(void)cfg_map_get(voptions, "trust-anchors",
+			(void)cfg_map_get(voptions, CFG_CLAUSE_TRUST_ANCHORS,
 					  &view_trust_anchors);
 			maps[i++] = voptions;
 		}
 	}
 
 	if (config != NULL) {
-		(void)cfg_map_get(config, "trust-anchors",
+		(void)cfg_map_get(config, CFG_CLAUSE_TRUST_ANCHORS,
 				  &global_trust_anchors);
-		(void)cfg_map_get(config, "options", &options);
+		(void)cfg_map_get(config, CFG_CLAUSE_OPTIONS, &options);
 		if (options != NULL) {
 			maps[i++] = options;
 		}
@@ -1070,7 +1071,7 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 				      "from '%s'",
 				      view->name, named_g_bindkeysfile);
 
-			CHECK(cfg_map_get(bindkeys, "trust-anchors",
+			CHECK(cfg_map_get(bindkeys, CFG_CLAUSE_TRUST_ANCHORS,
 					  &builtin_keys));
 
 			if (builtin_keys == NULL) {
@@ -1089,7 +1090,7 @@ configure_view_dnsseckeys(dns_view_t *view, const cfg_obj_t *vconfig,
 				      "using built-in root key for view %s",
 				      view->name);
 
-			CHECK(cfg_map_get(config, "builtin-trust-anchors",
+			CHECK(cfg_map_get(config, CFG_CLAUSE_BUILTIN_TRUST_ANCHORS,
 					  &builtin_keys));
 		}
 
@@ -1307,115 +1308,115 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 	RETERR(dns_peer_newprefix(mctx, &na, prefixlen, &peer));
 
 	obj = NULL;
-	(void)cfg_map_get(cpeer, "bogus", &obj);
+	(void)cfg_map_get(cpeer, CFG_CLAUSE_BOGUS, &obj);
 	if (obj != NULL) {
 		CHECK(dns_peer_setbogus(peer, cfg_obj_asboolean(obj)));
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(cpeer, "provide-ixfr", &obj);
+	(void)cfg_map_get(cpeer, CFG_CLAUSE_PROVIDE_IXFR, &obj);
 	if (obj != NULL) {
 		CHECK(dns_peer_setprovideixfr(peer, cfg_obj_asboolean(obj)));
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(cpeer, "request-expire", &obj);
+	(void)cfg_map_get(cpeer, CFG_CLAUSE_REQUEST_EXPIRE, &obj);
 	if (obj != NULL) {
 		CHECK(dns_peer_setrequestexpire(peer, cfg_obj_asboolean(obj)));
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(cpeer, "request-ixfr", &obj);
+	(void)cfg_map_get(cpeer, CFG_CLAUSE_REQUEST_IXFR, &obj);
 	if (obj != NULL) {
 		CHECK(dns_peer_setrequestixfr(peer, cfg_obj_asboolean(obj)));
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(cpeer, "request-ixfr-max-diffs", &obj);
+	(void)cfg_map_get(cpeer, CFG_CLAUSE_REQUEST_IXFR_MAX_DIFFS, &obj);
 	if (obj != NULL) {
 		CHECK(dns_peer_setrequestixfrmaxdiffs(peer,
 						      cfg_obj_asuint32(obj)));
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(cpeer, "request-nsid", &obj);
+	(void)cfg_map_get(cpeer, CFG_CLAUSE_REQUEST_NSID, &obj);
 	if (obj != NULL) {
 		CHECK(dns_peer_setrequestnsid(peer, cfg_obj_asboolean(obj)));
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(cpeer, "request-zoneversion", &obj);
+	(void)cfg_map_get(cpeer, CFG_CLAUSE_REQUEST_ZONEVERSION, &obj);
 	if (obj != NULL) {
 		CHECK(dns_peer_setrequestzoneversion(peer,
 						     cfg_obj_asboolean(obj)));
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(cpeer, "send-cookie", &obj);
+	(void)cfg_map_get(cpeer, CFG_CLAUSE_SEND_COOKIE, &obj);
 	if (obj != NULL) {
 		CHECK(dns_peer_setsendcookie(peer, cfg_obj_asboolean(obj)));
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(cpeer, "require-cookie", &obj);
+	(void)cfg_map_get(cpeer, CFG_CLAUSE_REQUIRE_COOKIE, &obj);
 	if (obj != NULL) {
 		CHECK(dns_peer_setrequirecookie(peer, cfg_obj_asboolean(obj)));
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(cpeer, "edns", &obj);
+	(void)cfg_map_get(cpeer, CFG_CLAUSE_EDNS, &obj);
 	if (obj != NULL) {
 		CHECK(dns_peer_setsupportedns(peer, cfg_obj_asboolean(obj)));
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(cpeer, "edns-udp-size", &obj);
+	(void)cfg_map_get(cpeer, CFG_CLAUSE_EDNS_UDP_SIZE, &obj);
 	if (obj != NULL) {
 		CHECK(dns_peer_setudpsize(peer,
 					  (uint16_t)cfg_obj_asuint32(obj)));
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(cpeer, "edns-version", &obj);
+	(void)cfg_map_get(cpeer, CFG_CLAUSE_EDNS_VERSION, &obj);
 	if (obj != NULL) {
 		CHECK(dns_peer_setednsversion(peer,
 					      (uint8_t)cfg_obj_asuint32(obj)));
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(cpeer, "max-udp-size", &obj);
+	(void)cfg_map_get(cpeer, CFG_CLAUSE_MAX_UDP_SIZE, &obj);
 	if (obj != NULL) {
 		CHECK(dns_peer_setmaxudp(peer,
 					 (uint16_t)cfg_obj_asuint32(obj)));
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(cpeer, "padding", &obj);
+	(void)cfg_map_get(cpeer, CFG_CLAUSE_PADDING, &obj);
 	if (obj != NULL) {
 		CHECK(dns_peer_setpadding(peer,
 					  (uint16_t)cfg_obj_asuint32(obj)));
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(cpeer, "tcp-only", &obj);
+	(void)cfg_map_get(cpeer, CFG_CLAUSE_TCP_ONLY, &obj);
 	if (obj != NULL) {
 		CHECK(dns_peer_setforcetcp(peer, cfg_obj_asboolean(obj)));
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(cpeer, "tcp-keepalive", &obj);
+	(void)cfg_map_get(cpeer, CFG_CLAUSE_TCP_KEEPALIVE, &obj);
 	if (obj != NULL) {
 		CHECK(dns_peer_settcpkeepalive(peer, cfg_obj_asboolean(obj)));
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(cpeer, "transfers", &obj);
+	(void)cfg_map_get(cpeer, CFG_CLAUSE_TRANSFERS, &obj);
 	if (obj != NULL) {
 		CHECK(dns_peer_settransfers(peer, cfg_obj_asuint32(obj)));
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(cpeer, "transfer-format", &obj);
+	(void)cfg_map_get(cpeer, CFG_CLAUSE_TRANSFER_FORMAT, &obj);
 	if (obj != NULL) {
 		const char *str = cfg_obj_asstring(obj);
 		if (strcasecmp(str, "many-answers") == 0) {
@@ -1429,16 +1430,16 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(cpeer, "keys", &obj);
+	(void)cfg_map_get(cpeer, CFG_CLAUSE_KEYS, &obj);
 	if (obj != NULL) {
 		CHECK(dns_peer_setkeybycharp(peer, cfg_obj_asstring(obj)));
 	}
 
 	obj = NULL;
 	if (na.family == AF_INET) {
-		(void)cfg_map_get(cpeer, "transfer-source", &obj);
+		(void)cfg_map_get(cpeer, CFG_CLAUSE_TRANSFER_SOURCE, &obj);
 	} else {
-		(void)cfg_map_get(cpeer, "transfer-source-v6", &obj);
+		(void)cfg_map_get(cpeer, CFG_CLAUSE_TRANSFER_SOURCE_V6, &obj);
 	}
 	if (obj != NULL) {
 		CHECK(dns_peer_settransfersource(peer,
@@ -1447,9 +1448,9 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 
 	obj = NULL;
 	if (na.family == AF_INET) {
-		(void)cfg_map_get(cpeer, "notify-source", &obj);
+		(void)cfg_map_get(cpeer, CFG_CLAUSE_NOTIFY_SOURCE, &obj);
 	} else {
-		(void)cfg_map_get(cpeer, "notify-source-v6", &obj);
+		(void)cfg_map_get(cpeer, CFG_CLAUSE_NOTIFY_SOURCE_V6, &obj);
 	}
 	if (obj != NULL) {
 		CHECK(dns_peer_setnotifysource(peer, cfg_obj_assockaddr(obj)));
@@ -1457,9 +1458,9 @@ configure_peer(const cfg_obj_t *cpeer, isc_mem_t *mctx, dns_peer_t **peerp) {
 
 	obj = NULL;
 	if (na.family == AF_INET) {
-		(void)cfg_map_get(cpeer, "query-source", &obj);
+		(void)cfg_map_get(cpeer, CFG_CLAUSE_QUERY_SOURCE, &obj);
 	} else {
-		(void)cfg_map_get(cpeer, "query-source-v6", &obj);
+		(void)cfg_map_get(cpeer, CFG_CLAUSE_QUERY_SOURCE_V6, &obj);
 	}
 	if (obj != NULL) {
 		INSIST(cfg_obj_issockaddr(obj));
@@ -2309,7 +2310,7 @@ catz_addmodzone_cb(void *arg) {
 		goto cleanup;
 	}
 	isc_buffer_free(&confbuf);
-	CHECK(cfg_map_get(zoneconf, "zone", &zlist));
+	CHECK(cfg_map_get(zoneconf, CFG_CLAUSE_ZONE, &zlist));
 	if (!cfg_obj_islist(zlist)) {
 		CLEANUP(ISC_R_FAILURE);
 	}
@@ -2581,7 +2582,7 @@ catz_reconfigure(dns_catz_entry_t *entry, void *arg1, void *arg2) {
 		goto cleanup;
 	}
 
-	CHECK(cfg_map_get(zoneconf, "zone", &zlist));
+	CHECK(cfg_map_get(zoneconf, CFG_CLAUSE_ZONE, &zlist));
 	if (!cfg_obj_islist(zlist)) {
 		CLEANUP(ISC_R_FAILURE);
 	}
@@ -2827,7 +2828,7 @@ configure_rrl(dns_view_t *view, const cfg_obj_t *config, const cfg_obj_t *map,
 	 */
 	min_entries = 500;
 	obj = NULL;
-	result = cfg_map_get(map, "min-table-size", &obj);
+	result = cfg_map_get(map, CFG_CLAUSE_MIN_TABLE_SIZE, &obj);
 	if (result == ISC_R_SUCCESS) {
 		min_entries = cfg_obj_asuint32(obj);
 		if (min_entries < 1) {
@@ -2838,7 +2839,7 @@ configure_rrl(dns_view_t *view, const cfg_obj_t *config, const cfg_obj_t *map,
 
 	i = ISC_MAX(20000, min_entries);
 	obj = NULL;
-	result = cfg_map_get(map, "max-table-size", &obj);
+	result = cfg_map_get(map, CFG_CLAUSE_MAX_TABLE_SIZE, &obj);
 	if (result == ISC_R_SUCCESS) {
 		i = cfg_obj_asuint32(obj);
 		CHECK_RRL(i >= min_entries,
@@ -2864,7 +2865,7 @@ configure_rrl(dns_view_t *view, const cfg_obj_t *config, const cfg_obj_t *map,
 
 	i = 15;
 	obj = NULL;
-	result = cfg_map_get(map, "window", &obj);
+	result = cfg_map_get(map, CFG_CLAUSE_WINDOW, &obj);
 	if (result == ISC_R_SUCCESS) {
 		i = cfg_obj_asuint32(obj);
 		CHECK_RRL(i >= 1 && i <= DNS_RRL_MAX_WINDOW,
@@ -2874,7 +2875,7 @@ configure_rrl(dns_view_t *view, const cfg_obj_t *config, const cfg_obj_t *map,
 
 	i = 0;
 	obj = NULL;
-	result = cfg_map_get(map, "qps-scale", &obj);
+	result = cfg_map_get(map, CFG_CLAUSE_QPS_SCALE, &obj);
 	if (result == ISC_R_SUCCESS) {
 		i = cfg_obj_asuint32(obj);
 		CHECK_RRL(i >= 1, "invalid 'qps-scale %d'%s", i, "");
@@ -2884,7 +2885,7 @@ configure_rrl(dns_view_t *view, const cfg_obj_t *config, const cfg_obj_t *map,
 
 	i = 24;
 	obj = NULL;
-	result = cfg_map_get(map, "ipv4-prefix-length", &obj);
+	result = cfg_map_get(map, CFG_CLAUSE_IPV4_PREFIX_LENGTH, &obj);
 	if (result == ISC_R_SUCCESS) {
 		i = cfg_obj_asuint32(obj);
 		CHECK_RRL(i >= 8 && i <= 32,
@@ -2899,7 +2900,7 @@ configure_rrl(dns_view_t *view, const cfg_obj_t *config, const cfg_obj_t *map,
 
 	i = 56;
 	obj = NULL;
-	result = cfg_map_get(map, "ipv6-prefix-length", &obj);
+	result = cfg_map_get(map, CFG_CLAUSE_IPV6_PREFIX_LENGTH, &obj);
 	if (result == ISC_R_SUCCESS) {
 		i = cfg_obj_asuint32(obj);
 		CHECK_RRL(i >= 16 && i <= DNS_RRL_MAX_PREFIX,
@@ -2919,7 +2920,7 @@ configure_rrl(dns_view_t *view, const cfg_obj_t *config, const cfg_obj_t *map,
 	}
 
 	obj = NULL;
-	result = cfg_map_get(map, "exempt-clients", &obj);
+	result = cfg_map_get(map, CFG_CLAUSE_EXEMPT_CLIENTS, &obj);
 	if (result == ISC_R_SUCCESS) {
 		result = cfg_acl_fromconfig(obj, config, aclctx, isc_g_mctx, 0,
 					    &rrl->exempt);
@@ -2928,7 +2929,7 @@ configure_rrl(dns_view_t *view, const cfg_obj_t *config, const cfg_obj_t *map,
 	}
 
 	obj = NULL;
-	result = cfg_map_get(map, "log-only", &obj);
+	result = cfg_map_get(map, CFG_CLAUSE_LOG_ONLY, &obj);
 	if (result == ISC_R_SUCCESS && cfg_obj_asboolean(obj)) {
 		rrl->log_only = true;
 	} else {
@@ -3045,9 +3046,9 @@ create_empty_zone(dns_zone_t *pzone, dns_name_t *name, dns_view_t *view,
 	contact = dns_fixedname_initname(&cfixed);
 
 	if (voptions != NULL) {
-		(void)cfg_map_get(voptions, "zone", &zonelist);
+		(void)cfg_map_get(voptions, CFG_CLAUSE_ZONE, &zonelist);
 	} else {
-		(void)cfg_map_get(config, "zone", &zonelist);
+		(void)cfg_map_get(config, CFG_CLAUSE_ZONE, &zonelist);
 	}
 	/*
 	 * Look for forward "zones" beneath this empty zone and if so
@@ -3652,7 +3653,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	REQUIRE(DNS_VIEW_VALID(view));
 
 	if (config != NULL) {
-		(void)cfg_map_get(config, "options", &options);
+		(void)cfg_map_get(config, CFG_CLAUSE_OPTIONS, &options);
 	}
 
 	/*
@@ -3702,9 +3703,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	 */
 	zonelist = NULL;
 	if (voptions != NULL) {
-		(void)cfg_map_get(voptions, "zone", &zonelist);
+		(void)cfg_map_get(voptions, CFG_CLAUSE_ZONE, &zonelist);
 	} else {
-		(void)cfg_map_get(config, "zone", &zonelist);
+		(void)cfg_map_get(config, CFG_CLAUSE_ZONE, &zonelist);
 	}
 
 	/*
@@ -3755,16 +3756,16 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	 */
 	dlzlist = NULL;
 	if (voptions != NULL) {
-		(void)cfg_map_get(voptions, "dlz", &dlzlist);
+		(void)cfg_map_get(voptions, CFG_CLAUSE_DLZ, &dlzlist);
 	} else {
-		(void)cfg_map_get(config, "dlz", &dlzlist);
+		(void)cfg_map_get(config, CFG_CLAUSE_DLZ, &dlzlist);
 	}
 
 	CFG_LIST_FOREACH(dlzlist, element) {
 		dlz = cfg_listelt_value(element);
 
 		obj = NULL;
-		(void)cfg_map_get(dlz, "database", &obj);
+		(void)cfg_map_get(dlz, CFG_CLAUSE_DATABASE, &obj);
 		if (obj != NULL) {
 			dns_dlzdb_t *dlzdb = NULL;
 			const cfg_obj_t *name, *search = NULL;
@@ -3793,7 +3794,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 			 * method now.  If not searchable, we'll take
 			 * care of it when we process the zone statement.
 			 */
-			(void)cfg_map_get(dlz, "search", &search);
+			(void)cfg_map_get(dlz, CFG_CLAUSE_SEARCH, &search);
 			if (search == NULL || cfg_obj_asboolean(search)) {
 				dlzdb->search = true;
 				CHECK(dns_dlzconfigure(view, dlzdb,
@@ -3954,7 +3955,7 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 					    &prefixlen);
 
 			obj = NULL;
-			(void)cfg_map_get(map, "suffix", &obj);
+			(void)cfg_map_get(map, CFG_CLAUSE_SUFFIX, &obj);
 			if (obj != NULL) {
 				sp = &suffix;
 				isc_netaddr_fromsockaddr(
@@ -3965,19 +3966,19 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 
 			clients = mapped = excluded = NULL;
 			obj = NULL;
-			(void)cfg_map_get(map, "clients", &obj);
+			(void)cfg_map_get(map, CFG_CLAUSE_CLIENTS, &obj);
 			if (obj != NULL) {
 				CHECK(cfg_acl_fromconfig(obj, config, aclctx,
 							 mctx, 0, &clients));
 			}
 			obj = NULL;
-			(void)cfg_map_get(map, "mapped", &obj);
+			(void)cfg_map_get(map, CFG_CLAUSE_MAPPED, &obj);
 			if (obj != NULL) {
 				CHECK(cfg_acl_fromconfig(obj, config, aclctx,
 							 mctx, 0, &mapped));
 			}
 			obj = NULL;
-			(void)cfg_map_get(map, "exclude", &obj);
+			(void)cfg_map_get(map, CFG_CLAUSE_EXCLUDE, &obj);
 			if (obj != NULL) {
 				CHECK(cfg_acl_fromconfig(obj, config, aclctx,
 							 mctx, 0, &excluded));
@@ -3989,13 +3990,13 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 			}
 
 			obj = NULL;
-			(void)cfg_map_get(map, "recursive-only", &obj);
+			(void)cfg_map_get(map, CFG_CLAUSE_RECURSIVE_ONLY, &obj);
 			if (obj != NULL && cfg_obj_asboolean(obj)) {
 				dns64options |= DNS_DNS64_RECURSIVE_ONLY;
 			}
 
 			obj = NULL;
-			(void)cfg_map_get(map, "break-dnssec", &obj);
+			(void)cfg_map_get(map, CFG_CLAUSE_BREAK_DNSSEC, &obj);
 			if (obj != NULL && cfg_obj_asboolean(obj)) {
 				dns64options |= DNS_DNS64_BREAK_DNSSEC;
 			}
@@ -4988,9 +4989,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	 */
 	dyndb_list = NULL;
 	if (voptions != NULL) {
-		(void)cfg_map_get(voptions, "dyndb", &dyndb_list);
+		(void)cfg_map_get(voptions, CFG_CLAUSE_DYNDB, &dyndb_list);
 	} else {
-		(void)cfg_map_get(config, "dyndb", &dyndb_list);
+		(void)cfg_map_get(config, CFG_CLAUSE_DYNDB, &dyndb_list);
 	}
 
 	CFG_LIST_FOREACH(dyndb_list, element) {
@@ -5010,9 +5011,9 @@ configure_view(dns_view_t *view, dns_viewlist_t *viewlist, cfg_obj_t *config,
 	 */
 	plugin_list = NULL;
 	if (voptions != NULL) {
-		(void)cfg_map_get(voptions, "plugin", &plugin_list);
+		(void)cfg_map_get(voptions, CFG_CLAUSE_PLUGIN, &plugin_list);
 	} else {
-		(void)cfg_map_get(config, "plugin", &plugin_list);
+		(void)cfg_map_get(config, CFG_CLAUSE_PLUGIN, &plugin_list);
 	}
 
 	if (plugin_list != NULL) {
@@ -5904,7 +5905,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	bool fullsign = false;
 
 	options = NULL;
-	(void)cfg_map_get(config, "options", &options);
+	(void)cfg_map_get(config, CFG_CLAUSE_OPTIONS, &options);
 
 	zoptions = cfg_tuple_get(zconfig, "options");
 	toptions = named_zone_templateopts(config, zoptions);
@@ -5938,7 +5939,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 		CLEANUP(ISC_R_FAILURE);
 	}
 
-	(void)cfg_map_get(zoptions, "in-view", &viewobj);
+	(void)cfg_map_get(zoptions, CFG_CLAUSE_IN_VIEW, &viewobj);
 	if (viewobj != NULL) {
 		const char *inview = cfg_obj_asstring(viewobj);
 		dns_view_t *otherview = NULL;
@@ -5977,10 +5978,10 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 		 * other view.
 		 */
 		forwarders = NULL;
-		result = cfg_map_get(zoptions, "forwarders", &forwarders);
+		result = cfg_map_get(zoptions, CFG_CLAUSE_FORWARDERS, &forwarders);
 		if (result == ISC_R_SUCCESS) {
 			forwardtype = NULL;
-			(void)cfg_map_get(zoptions, "forward", &forwardtype);
+			(void)cfg_map_get(zoptions, CFG_CLAUSE_FORWARD, &forwardtype);
 			CHECK(configure_forward(config, view, origin,
 						forwarders, forwardtype));
 		}
@@ -7012,7 +7013,7 @@ setup_newzones(dns_view_t *view, cfg_obj_t *config, cfg_obj_t *vconfig) {
 	if (voptions != NULL) {
 		maps[i++] = voptions;
 	}
-	result = cfg_map_get(config, "options", &options);
+	result = cfg_map_get(config, CFG_CLAUSE_OPTIONS, &options);
 	if (result == ISC_R_SUCCESS) {
 		maps[i++] = options;
 	}
@@ -7297,7 +7298,7 @@ for_all_newzone_cfgs(newzone_cfg_cb_t callback, cfg_obj_t *config,
 		 * Extract zone configuration from configuration object.
 		 */
 		zlist = NULL;
-		result = cfg_map_get(zconfigobj, "zone", &zlist);
+		result = cfg_map_get(zconfigobj, CFG_CLAUSE_ZONE, &zlist);
 		if (result != ISC_R_SUCCESS) {
 			break;
 		} else if (!cfg_obj_islist(zlist)) {
@@ -7421,7 +7422,7 @@ create_views(cfg_obj_t *config, dns_viewlist_t *viewlist, bool *nzp) {
 
 	APPLY_CONFIGURATION_SUBROUTINE_LOG;
 
-	(void)cfg_map_get(config, "view", &views);
+	(void)cfg_map_get(config, CFG_CLAUSE_VIEW, &views);
 	CFG_LIST_FOREACH(views, element) {
 		cfg_obj_t *vconfig = cfg_listelt_value(element);
 		const char *vname = NULL;
@@ -7500,7 +7501,7 @@ configure_views(cfg_obj_t *config, const cfg_obj_t *bindkeys,
 	 * views that have zones were already created at parsing
 	 * time, but views with no zones must be created here.
 	 */
-	(void)cfg_map_get(config, "view", &views);
+	(void)cfg_map_get(config, CFG_CLAUSE_VIEW, &views);
 	CFG_LIST_FOREACH(views, element) {
 		cfg_obj_t *vconfig = cfg_listelt_value(element);
 		dns_view_t *view = NULL;
@@ -7585,7 +7586,7 @@ configure_keystores(const cfg_obj_t *config, dns_keystorelist_t *keystorelist) {
 	 * Create the DNSSEC key stores.
 	 */
 	keystores = NULL;
-	(void)cfg_map_get(config, "key-store", &keystores);
+	(void)cfg_map_get(config, CFG_CLAUSE_KEY_STORE, &keystores);
 	CFG_LIST_FOREACH(keystores, element) {
 		cfg_obj_t *kconfig = cfg_listelt_value(element);
 
@@ -7611,7 +7612,7 @@ configure_kasplist(const cfg_obj_t *config, dns_kasplist_t *kasplist,
 	/*
 	 * Create the DNSSEC key and signing policies (KASP).
 	 */
-	(void)cfg_map_get(config, "dnssec-policy", &kasps);
+	(void)cfg_map_get(config, CFG_CLAUSE_DNSSEC_POLICY, &kasps);
 	CFG_LIST_FOREACH(kasps, element) {
 		cfg_obj_t *kconfig = cfg_listelt_value(element);
 		dns_kasp_t *kasp = NULL;
@@ -7690,7 +7691,7 @@ apply_configuration(cfg_obj_t *effectiveconfig, cfg_obj_t *bindkeys,
 	 */
 	i = 0;
 	options = NULL;
-	result = cfg_map_get(effectiveconfig, "options", &options);
+	result = cfg_map_get(effectiveconfig, CFG_CLAUSE_OPTIONS, &options);
 	if (result == ISC_R_SUCCESS) {
 		maps[i++] = options;
 	}
@@ -8346,7 +8347,7 @@ apply_configuration(cfg_obj_t *effectiveconfig, cfg_obj_t *bindkeys,
 			      "statement for logging due to "
 			      "-g option");
 
-		(void)cfg_map_get(effectiveconfig, "logging", &logobj);
+		(void)cfg_map_get(effectiveconfig, CFG_CLAUSE_LOGGING, &logobj);
 		if (logobj != NULL) {
 			result = named_logconfig(NULL, logobj);
 			if (result != ISC_R_SUCCESS) {
@@ -8365,7 +8366,7 @@ apply_configuration(cfg_obj_t *effectiveconfig, cfg_obj_t *bindkeys,
 		isc_logconfig_create(&logc);
 
 		logobj = NULL;
-		(void)cfg_map_get(effectiveconfig, "logging", &logobj);
+		(void)cfg_map_get(effectiveconfig, CFG_CLAUSE_LOGGING, &logobj);
 		if (logobj != NULL) {
 			result = named_logconfig(logc, logobj);
 			if (result != ISC_R_SUCCESS) {
@@ -8425,9 +8426,9 @@ apply_configuration(cfg_obj_t *effectiveconfig, cfg_obj_t *bindkeys,
 			ns_server_setoption(server->sctx, NS_SERVER_LOGQUERIES,
 					    cfg_obj_asboolean(obj));
 		} else {
-			(void)cfg_map_get(effectiveconfig, "logging", &logobj);
+			(void)cfg_map_get(effectiveconfig, CFG_CLAUSE_LOGGING, &logobj);
 			if (logobj != NULL) {
-				(void)cfg_map_get(logobj, "category",
+				(void)cfg_map_get(logobj, CFG_CLAUSE_CATEGORY,
 						  &categories);
 			}
 			if (categories != NULL) {
@@ -8458,7 +8459,7 @@ apply_configuration(cfg_obj_t *effectiveconfig, cfg_obj_t *bindkeys,
 
 	obj = NULL;
 	if (options != NULL &&
-	    cfg_map_get(options, "memstatistics", &obj) == ISC_R_SUCCESS)
+	    cfg_map_get(options, CFG_CLAUSE_MEMSTATISTICS, &obj) == ISC_R_SUCCESS)
 	{
 		named_g_memstatistics = cfg_obj_asboolean(obj);
 	} else {
@@ -10328,19 +10329,19 @@ listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 				return ISC_R_FAILURE;
 			}
 
-			CHECK(cfg_map_get(tlsmap, "key-file", &keyobj));
+			CHECK(cfg_map_get(tlsmap, CFG_CLAUSE_KEY_FILE, &keyobj));
 			key = cfg_obj_asstring(keyobj);
 
-			CHECK(cfg_map_get(tlsmap, "cert-file", &certobj));
+			CHECK(cfg_map_get(tlsmap, CFG_CLAUSE_CERT_FILE, &certobj));
 			cert = cfg_obj_asstring(certobj);
 
-			if (cfg_map_get(tlsmap, "ca-file", &ca_obj) ==
+			if (cfg_map_get(tlsmap, CFG_CLAUSE_CA_FILE, &ca_obj) ==
 			    ISC_R_SUCCESS)
 			{
 				ca_file = cfg_obj_asstring(ca_obj);
 			}
 
-			if (cfg_map_get(tlsmap, "protocols", &tls_proto_list) ==
+			if (cfg_map_get(tlsmap, CFG_CLAUSE_PROTOCOLS, &tls_proto_list) ==
 			    ISC_R_SUCCESS)
 			{
 				INSIST(tls_proto_list != NULL);
@@ -10360,26 +10361,26 @@ listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 				}
 			}
 
-			if (cfg_map_get(tlsmap, "dhparam-file", &dhparam_obj) ==
+			if (cfg_map_get(tlsmap, CFG_CLAUSE_DHPARAM_FILE, &dhparam_obj) ==
 			    ISC_R_SUCCESS)
 			{
 				dhparam_file = cfg_obj_asstring(dhparam_obj);
 			}
 
-			if (cfg_map_get(tlsmap, "ciphers", &ciphers_obj) ==
+			if (cfg_map_get(tlsmap, CFG_CLAUSE_CIPHERS, &ciphers_obj) ==
 			    ISC_R_SUCCESS)
 			{
 				ciphers = cfg_obj_asstring(ciphers_obj);
 			}
 
-			if (cfg_map_get(tlsmap, "cipher-suites",
+			if (cfg_map_get(tlsmap, CFG_CLAUSE_CIPHER_SUITES,
 					&cipher_suites_obj) == ISC_R_SUCCESS)
 			{
 				cipher_suites =
 					cfg_obj_asstring(cipher_suites_obj);
 			}
 
-			if (cfg_map_get(tlsmap, "prefer-server-ciphers",
+			if (cfg_map_get(tlsmap, CFG_CLAUSE_PREFER_SERVER_CIPHERS,
 					&prefer_server_ciphers_obj) ==
 			    ISC_R_SUCCESS)
 			{
@@ -10388,7 +10389,7 @@ listenelt_fromconfig(const cfg_obj_t *listener, const cfg_obj_t *config,
 				tls_prefer_server_ciphers_set = true;
 			}
 
-			if (cfg_map_get(tlsmap, "session-tickets",
+			if (cfg_map_get(tlsmap, CFG_CLAUSE_SESSION_TICKETS,
 					&session_tickets_obj) == ISC_R_SUCCESS)
 			{
 				tls_session_tickets =
@@ -10544,19 +10545,19 @@ listenelt_http(const cfg_obj_t *http, const uint16_t family, bool tls,
 		const cfg_obj_t *cfg_max_clients = NULL;
 		const cfg_obj_t *cfg_max_streams = NULL;
 
-		if (cfg_map_get(http, "endpoints", &eplist) == ISC_R_SUCCESS) {
+		if (cfg_map_get(http, CFG_CLAUSE_ENDPOINTS, &eplist) == ISC_R_SUCCESS) {
 			INSIST(eplist != NULL);
 			len = cfg_list_length(eplist, false);
 		}
 
-		if (cfg_map_get(http, "listener-clients", &cfg_max_clients) ==
+		if (cfg_map_get(http, CFG_CLAUSE_LISTENER_CLIENTS, &cfg_max_clients) ==
 		    ISC_R_SUCCESS)
 		{
 			INSIST(cfg_max_clients != NULL);
 			max_clients = cfg_obj_asuint32(cfg_max_clients);
 		}
 
-		if (cfg_map_get(http, "streams-per-connection",
+		if (cfg_map_get(http, CFG_CLAUSE_STREAMS_PER_CONNECTION,
 				&cfg_max_streams) == ISC_R_SUCCESS)
 		{
 			INSIST(cfg_max_streams != NULL);
@@ -11932,7 +11933,7 @@ newzone_parse(named_server_t *server, char *command, dns_view_t **viewp,
 	CHECK(cfg_parse_buffer(&argbuf, bn, 0, &cfg_type_addzoneconf, 0,
 			       &zoneconf));
 
-	CHECK(cfg_map_get(zoneconf, "zone", &zlist));
+	CHECK(cfg_map_get(zoneconf, CFG_CLAUSE_ZONE, &zlist));
 	if (!cfg_obj_islist(zlist)) {
 		CLEANUP(ISC_R_FAILURE);
 	}
@@ -11944,16 +11945,16 @@ newzone_parse(named_server_t *server, char *command, dns_view_t **viewp,
 	zoptions = cfg_tuple_get(zoneobj, "options");
 
 	obj = NULL;
-	(void)cfg_map_get(zoptions, "type", &obj);
+	(void)cfg_map_get(zoptions, CFG_CLAUSE_TYPE, &obj);
 	if (obj == NULL) {
-		(void)cfg_map_get(zoptions, "in-view", &obj);
+		(void)cfg_map_get(zoptions, CFG_CLAUSE_IN_VIEW, &obj);
 		if (obj != NULL) {
 			(void)putstr(text, "'in-view' zones not supported by ");
 			(void)putstr(text, bn);
 			CLEANUP(ISC_R_FAILURE);
 		}
 
-		(void)cfg_map_get(zoptions, "template", &obj);
+		(void)cfg_map_get(zoptions, CFG_CLAUSE_TEMPLATE, &obj);
 		if (obj == NULL) {
 			(void)putstr(text, "no zone type or "
 					   "template specified");
@@ -12024,7 +12025,7 @@ delete_zoneconf(dns_view_t *view, const cfg_obj_t *config,
 	REQUIRE(config != NULL);
 	REQUIRE(zname != NULL);
 
-	cfg_map_get(config, "zone", &zl);
+	cfg_map_get(config, CFG_CLAUSE_ZONE, &zl);
 
 	if (!cfg_obj_islist(zl)) {
 		return ISC_R_FAILURE;
diff --git a/bin/named/statschannel.c b/bin/named/statschannel.c
index 56b473cf3dd..7757c218eb6 100644
--- a/bin/named/statschannel.c
+++ b/bin/named/statschannel.c
@@ -37,6 +37,7 @@
 #include <dns/view.h>
 #include <dns/xfrin.h>
 #include <dns/zt.h>
+#include <isccfg/clause.h>
 
 #include <ns/stats.h>
 
@@ -3939,7 +3940,7 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 	/*
 	 * Get the list of named.conf 'statistics-channels' statements.
 	 */
-	(void)cfg_map_get(config, "statistics-channels", &statschannellist);
+	(void)cfg_map_get(config, CFG_CLAUSE_STATISTICS_CHANNELS, &statschannellist);
 
 	/*
 	 * Run through the new address/port list, noting sockets that are
@@ -3975,7 +3976,7 @@ named_statschannels_configure(named_server_t *server, const cfg_obj_t *config,
 			const cfg_obj_t *listenercfg = NULL;
 
 			statschannel = cfg_listelt_value(element);
-			(void)cfg_map_get(statschannel, "inet", &listenercfg);
+			(void)cfg_map_get(statschannel, CFG_CLAUSE_INET, &listenercfg);
 			if (listenercfg == NULL) {
 				continue;
 			}
diff --git a/bin/named/tkeyconf.c b/bin/named/tkeyconf.c
index 633d19c61e4..b50734b6f77 100644
--- a/bin/named/tkeyconf.c
+++ b/bin/named/tkeyconf.c
@@ -19,6 +19,7 @@
 
 #include <dst/gssapi.h>
 
+#include <isccfg/clause.h>
 #include <isccfg/cfg.h>
 
 #include <named/log.h>
@@ -33,7 +34,7 @@ named_tkeyctx_fromconfig(const cfg_obj_t *options, isc_mem_t *mctx,
 
 	dns_tkeyctx_create(mctx, &tctx);
 
-	result = cfg_map_get(options, "tkey-gssapi-keytab", &obj);
+	result = cfg_map_get(options, CFG_CLAUSE_TKEY_GSSAPI_KEYTAB, &obj);
 	if (result == ISC_R_SUCCESS) {
 		const char *s = cfg_obj_asstring(obj);
 		tctx->gssapi_keytab = isc_mem_strdup(mctx, s);
diff --git a/bin/named/transportconf.c b/bin/named/transportconf.c
index 5f3701b3936..c06ec161aa0 100644
--- a/bin/named/transportconf.c
+++ b/bin/named/transportconf.c
@@ -22,6 +22,7 @@
 #include <dns/name.h>
 #include <dns/transport.h>
 
+#include <isccfg/clause.h>
 #include <isccfg/cfg.h>
 
 #include <named/log.h>
@@ -188,14 +189,14 @@ transport_list_fromconfig(const cfg_obj_t *config, dns_transport_list_t *list) {
 	isc_result_t result = ISC_R_SUCCESS;
 
 	if (result == ISC_R_SUCCESS &&
-	    cfg_map_get(config, "tls", &obj) == ISC_R_SUCCESS)
+	    cfg_map_get(config, CFG_CLAUSE_TLS, &obj) == ISC_R_SUCCESS)
 	{
 		result = add_tls_transports(obj, list);
 		obj = NULL;
 	}
 
 	if (result == ISC_R_SUCCESS &&
-	    cfg_map_get(config, "doh", &obj) == ISC_R_SUCCESS)
+	    cfg_map_get(config, CFG_CLAUSE_DOH, &obj) == ISC_R_SUCCESS)
 	{
 		result = add_doh_transports(obj, list);
 		obj = NULL;
diff --git a/bin/named/tsigconf.c b/bin/named/tsigconf.c
index 1a790a6823f..c075ebc5bd2 100644
--- a/bin/named/tsigconf.c
+++ b/bin/named/tsigconf.c
@@ -24,6 +24,7 @@
 
 #include <dns/tsig.h>
 
+#include <isccfg/clause.h>
 #include <isccfg/cfg.h>
 
 #include <named/config.h>
@@ -58,8 +59,8 @@ add_initial_keys(const cfg_obj_t *list, dns_tsigkeyring_t *ring,
 
 		algobj = NULL;
 		secretobj = NULL;
-		(void)cfg_map_get(key, "algorithm", &algobj);
-		(void)cfg_map_get(key, "secret", &secretobj);
+		(void)cfg_map_get(key, CFG_CLAUSE_ALGORITHM, &algobj);
+		(void)cfg_map_get(key, CFG_CLAUSE_SECRET, &secretobj);
 		INSIST(algobj != NULL && secretobj != NULL);
 
 		/*
@@ -148,7 +149,7 @@ named_tsigkeyring_fromconfig(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 			break;
 		}
 		keylist = NULL;
-		result = cfg_map_get(maps[i], "key", &keylist);
+		result = cfg_map_get(maps[i], CFG_CLAUSE_KEY, &keylist);
 		if (result != ISC_R_SUCCESS) {
 			continue;
 		}
diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
index 0e422d33ed2..a1ab31eabf0 100644
--- a/bin/named/zoneconf.c
+++ b/bin/named/zoneconf.c
@@ -42,6 +42,7 @@
 #include <dns/tsig.h>
 #include <dns/view.h>
 #include <dns/zone.h>
+#include <isccfg/clause.h>
 
 #include <ns/client.h>
 #include <ns/hooks.h>
@@ -158,7 +159,7 @@ configure_zone_acl(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	}
 	if (config != NULL) {
 		const cfg_obj_t *options = NULL;
-		(void)cfg_map_get(config, "options", &options);
+		(void)cfg_map_get(config, CFG_CLAUSE_OPTIONS, &options);
 		if (options != NULL) {
 			maps[i++] = options;
 		}
@@ -863,7 +864,7 @@ process_notify_options(dns_rdatatype_t type, const cfg_obj_t **maps,
 	 */
 	if (notifycfg) {
 		obj = NULL;
-		result = cfg_map_get(maps[0], "notify", &obj);
+		result = cfg_map_get(maps[0], CFG_CLAUSE_NOTIFY, &obj);
 		if (result == ISC_R_SUCCESS && obj != NULL) {
 			dns_zone_setnotifytype(zone, type,
 					       cfg_obj_asboolean(obj));
@@ -1019,7 +1020,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		i++;
 	}
 
-	(void)cfg_map_get(config, "options", &options);
+	(void)cfg_map_get(config, CFG_CLAUSE_OPTIONS, &options);
 	if (options != NULL) {
 		nodefault[i] = maps[i] = options;
 		i++;
@@ -2106,7 +2107,7 @@ named_zone_inlinesigning(const cfg_obj_t *zconfig, const cfg_obj_t *vconfig,
 	}
 	if (config != NULL) {
 		const cfg_obj_t *options = NULL;
-		(void)cfg_map_get(config, "options", &options);
+		(void)cfg_map_get(config, CFG_CLAUSE_OPTIONS, &options);
 		if (options != NULL) {
 			maps[i++] = options;
 		}
@@ -2150,8 +2151,8 @@ named_zone_templateopts(const cfg_obj_t *config, const cfg_obj_t *zoptions) {
 	const cfg_obj_t *templates = NULL;
 	const cfg_obj_t *obj = NULL;
 
-	(void)cfg_map_get(config, "template", &templates);
-	(void)cfg_map_get(zoptions, "template", &obj);
+	(void)cfg_map_get(config, CFG_CLAUSE_TEMPLATE, &templates);
+	(void)cfg_map_get(zoptions, CFG_CLAUSE_TEMPLATE, &obj);
 	if (obj != NULL && templates != NULL) {
 		const char *tmplname = cfg_obj_asstring(obj);
 		CFG_LIST_FOREACH(templates, e) {
@@ -2186,11 +2187,11 @@ named_zone_loadplugins(dns_zone_t *zone, const cfg_obj_t *config,
 	 * Load zone-specific plugin instances.
 	 */
 	if (toptions != NULL) {
-		(void)cfg_map_get(toptions, "plugin", &tpluginlist);
+		(void)cfg_map_get(toptions, CFG_CLAUSE_PLUGIN, &tpluginlist);
 	}
 
 	if (zoptions != NULL) {
-		(void)cfg_map_get(zoptions, "plugin", &zpluginlist);
+		(void)cfg_map_get(zoptions, CFG_CLAUSE_PLUGIN, &zpluginlist);
 	}
 
 	if (tpluginlist != NULL || zpluginlist != NULL) {
diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
index a51441e2a14..54dc8e0a0c9 100644
--- a/bin/nsupdate/nsupdate.c
+++ b/bin/nsupdate/nsupdate.c
@@ -73,6 +73,7 @@
 
 #include <dst/dst.h>
 
+#include <isccfg/clause.h>
 #include <isccfg/namedconf.h>
 
 #include <irs/resconf.h>
@@ -571,10 +572,10 @@ read_sessionkey(isc_mem_t *mctx) {
 
 	CHECK(cfg_parse_file(keyfile, &cfg_type_sessionkey, 0, &sessionkey));
 
-	CHECK(cfg_map_get(sessionkey, "key", &key));
+	CHECK(cfg_map_get(sessionkey, CFG_CLAUSE_KEY, &key));
 
-	(void)cfg_map_get(key, "secret", &secretobj);
-	(void)cfg_map_get(key, "algorithm", &algorithmobj);
+	(void)cfg_map_get(key, CFG_CLAUSE_SECRET, &secretobj);
+	(void)cfg_map_get(key, CFG_CLAUSE_ALGORITHM, &algorithmobj);
 	if (secretobj == NULL || algorithmobj == NULL) {
 		fatal("key must have algorithm and secret");
 	}
diff --git a/bin/plugins/filter-a.c b/bin/plugins/filter-a.c
index 2da1d338c86..c4034510ebe 100644
--- a/bin/plugins/filter-a.c
+++ b/bin/plugins/filter-a.c
@@ -183,13 +183,13 @@ static cfg_type_t cfg_type_filter_a = {
 	doc_filter_a, &cfg_rep_string, filter_a_enums,
 };
 
-static cfg_clausedef_t param_clauses[] = {
+static cfg_clausedef_external_t param_clauses[] = {
 	{ "filter-a", &cfg_type_bracketed_aml, 0, NULL },
 	{ "filter-a-on-v6", &cfg_type_filter_a, 0, NULL },
 	{ "filter-a-on-v4", &cfg_type_filter_a, 0, NULL },
 };
 
-static cfg_clausedef_t *param_clausesets[] = { param_clauses, NULL };
+static cfg_clausedef_external_t *param_clausesets[] = { param_clauses, NULL };
 
 static cfg_type_t cfg_type_parameters = {
 	"filter-a-params",	    cfg_parse_mapbody_external,
diff --git a/bin/plugins/filter-aaaa.c b/bin/plugins/filter-aaaa.c
index 66fec600e21..13b7ba14b62 100644
--- a/bin/plugins/filter-aaaa.c
+++ b/bin/plugins/filter-aaaa.c
@@ -183,13 +183,13 @@ static cfg_type_t cfg_type_filter_aaaa = {
 	doc_filter_aaaa, &cfg_rep_string,   filter_aaaa_enums,
 };
 
-static cfg_clausedef_t param_clauses[] = {
+static cfg_clausedef_external_t param_clauses[] = {
 	{ "filter-aaaa", &cfg_type_bracketed_aml, 0, NULL },
 	{ "filter-aaaa-on-v4", &cfg_type_filter_aaaa, 0, NULL },
 	{ "filter-aaaa-on-v6", &cfg_type_filter_aaaa, 0, NULL },
 };
 
-static cfg_clausedef_t *param_clausesets[] = { param_clauses, NULL };
+static cfg_clausedef_external_t *param_clausesets[] = { param_clauses, NULL };
 
 static cfg_type_t cfg_type_parameters = {
 	"filter-aaaa-params",	    cfg_parse_mapbody_external,
diff --git a/bin/plugins/synthrecord.c b/bin/plugins/synthrecord.c
index 8d1470af32d..409e29b8317 100644
--- a/bin/plugins/synthrecord.c
+++ b/bin/plugins/synthrecord.c
@@ -389,14 +389,14 @@ synthrecord_entry(void *arg, void *cbdata, isc_result_t *resp) {
 	}
 }
 
-static cfg_clausedef_t synthrecord_cfgclauses[] = {
+static cfg_clausedef_external_t synthrecord_cfgclauses[] = {
 	{ "prefix", &cfg_type_astring, 0, NULL },
 	{ "origin", &cfg_type_astring, 0, NULL },
 	{ "allow-synth", &cfg_type_bracketed_aml, 0, NULL },
 	{ "ttl", &cfg_type_uint32, 0, NULL }
 };
 
-static cfg_clausedef_t *synthrecord_cfgparamsclausesets[] = {
+static cfg_clausedef_external_t *synthrecord_cfgparamsclausesets[] = {
 	synthrecord_cfgclauses, NULL
 };
 
diff --git a/bin/rndc/rndc.c b/bin/rndc/rndc.c
index faa3115f311..db3d61e41fd 100644
--- a/bin/rndc/rndc.c
+++ b/bin/rndc/rndc.c
@@ -48,6 +48,7 @@
 #include <isccc/types.h>
 #include <isccc/util.h>
 
+#include <isccfg/clause.h>
 #include <isccfg/namedconf.h>
 
 #include "util.h"
@@ -591,14 +592,14 @@ parse_config(const char *keyname, cfg_obj_t **configp) {
 	}
 
 	if (!key_only) {
-		(void)cfg_map_get(config, "options", &options);
+		(void)cfg_map_get(config, CFG_CLAUSE_OPTIONS, &options);
 	}
 
 	if (key_only && servername == NULL) {
 		servername = "127.0.0.1";
 	} else if (servername == NULL && options != NULL) {
 		const cfg_obj_t *defserverobj = NULL;
-		(void)cfg_map_get(options, "default-server", &defserverobj);
+		(void)cfg_map_get(options, CFG_CLAUSE_DEFAULT_SERVER, &defserverobj);
 		if (defserverobj != NULL) {
 			servername = cfg_obj_asstring(defserverobj);
 		}
@@ -609,7 +610,7 @@ parse_config(const char *keyname, cfg_obj_t **configp) {
 	}
 
 	if (!key_only) {
-		(void)cfg_map_get(config, "server", &servers);
+		(void)cfg_map_get(config, CFG_CLAUSE_SERVER, &servers);
 		if (servers != NULL) {
 			CFG_LIST_FOREACH(servers, elt) {
 				const char *name = NULL;
@@ -630,11 +631,11 @@ parse_config(const char *keyname, cfg_obj_t **configp) {
 	if (keyname != NULL) {
 		/* Was set on command line, do nothing. */
 	} else if (server != NULL) {
-		DO("get key for server", cfg_map_get(server, "key", &defkey));
+		DO("get key for server", cfg_map_get(server, CFG_CLAUSE_KEY, &defkey));
 		keyname = cfg_obj_asstring(defkey);
 	} else if (options != NULL) {
 		DO("get default key",
-		   cfg_map_get(options, "default-key", &defkey));
+		   cfg_map_get(options, CFG_CLAUSE_DEFAULT_KEY, &defkey));
 		keyname = cfg_obj_asstring(defkey);
 	} else if (!key_only) {
 		fatal("no key for server and no default");
@@ -644,9 +645,9 @@ parse_config(const char *keyname, cfg_obj_t **configp) {
 	 * Get the key's definition.
 	 */
 	if (key_only) {
-		DO("get key", cfg_map_get(config, "key", &key));
+		DO("get key", cfg_map_get(config, CFG_CLAUSE_KEY, &key));
 	} else {
-		DO("get config key list", cfg_map_get(config, "key", &keys));
+		DO("get config key list", cfg_map_get(config, CFG_CLAUSE_KEY, &keys));
 		bool match = false;
 		CFG_LIST_FOREACH(keys, elt) {
 			const char *name = NULL;
@@ -662,8 +663,8 @@ parse_config(const char *keyname, cfg_obj_t **configp) {
 			fatal("no key definition for name %s", keyname);
 		}
 	}
-	(void)cfg_map_get(key, "secret", &secretobj);
-	(void)cfg_map_get(key, "algorithm", &algorithmobj);
+	(void)cfg_map_get(key, CFG_CLAUSE_SECRET, &secretobj);
+	(void)cfg_map_get(key, CFG_CLAUSE_ALGORITHM, &algorithmobj);
 	if (secretobj == NULL || algorithmobj == NULL) {
 		fatal("key must have algorithm and secret");
 	}
@@ -700,10 +701,10 @@ parse_config(const char *keyname, cfg_obj_t **configp) {
 		/* Was set on command line, do nothing. */
 	} else {
 		if (server != NULL) {
-			(void)cfg_map_get(server, "port", &defport);
+			(void)cfg_map_get(server, CFG_CLAUSE_PORT, &defport);
 		}
 		if (defport == NULL && options != NULL) {
-			(void)cfg_map_get(options, "default-port", &defport);
+			(void)cfg_map_get(options, CFG_CLAUSE_DEFAULT_PORT, &defport);
 		}
 	}
 	if (defport != NULL) {
@@ -716,7 +717,7 @@ parse_config(const char *keyname, cfg_obj_t **configp) {
 	}
 
 	if (server != NULL) {
-		result = cfg_map_get(server, "addresses", &addresses);
+		result = cfg_map_get(server, CFG_CLAUSE_ADDRESSES, &addresses);
 	} else {
 		result = ISC_R_NOTFOUND;
 	}
@@ -773,7 +774,7 @@ parse_config(const char *keyname, cfg_obj_t **configp) {
 
 	if (!local4set && server != NULL) {
 		address = NULL;
-		cfg_map_get(server, "source-address", &address);
+		cfg_map_get(server, CFG_CLAUSE_SOURCE_ADDRESS, &address);
 		if (address != NULL) {
 			local4 = *cfg_obj_assockaddr(address);
 			local4set = true;
@@ -781,7 +782,7 @@ parse_config(const char *keyname, cfg_obj_t **configp) {
 	}
 	if (!local4set && options != NULL) {
 		address = NULL;
-		cfg_map_get(options, "default-source-address", &address);
+		cfg_map_get(options, CFG_CLAUSE_DEFAULT_SOURCE_ADDRESS, &address);
 		if (address != NULL) {
 			local4 = *cfg_obj_assockaddr(address);
 			local4set = true;
@@ -790,7 +791,7 @@ parse_config(const char *keyname, cfg_obj_t **configp) {
 
 	if (!local6set && server != NULL) {
 		address = NULL;
-		cfg_map_get(server, "source-address-v6", &address);
+		cfg_map_get(server, CFG_CLAUSE_SOURCE_ADDRESS_V6, &address);
 		if (address != NULL) {
 			local6 = *cfg_obj_assockaddr(address);
 			local6set = true;
@@ -798,7 +799,7 @@ parse_config(const char *keyname, cfg_obj_t **configp) {
 	}
 	if (!local6set && options != NULL) {
 		address = NULL;
-		cfg_map_get(options, "default-source-address-v6", &address);
+		cfg_map_get(options, CFG_CLAUSE_DEFAULT_SOURCE_ADDRESS_V6, &address);
 		if (address != NULL) {
 			local6 = *cfg_obj_assockaddr(address);
 			local6set = true;
diff --git a/bin/tests/system/hooks/driver/test-syncplugin.c b/bin/tests/system/hooks/driver/test-syncplugin.c
index 62bca1842be..8078e082a4c 100644
--- a/bin/tests/system/hooks/driver/test-syncplugin.c
+++ b/bin/tests/system/hooks/driver/test-syncplugin.c
@@ -57,13 +57,13 @@ syncplugin__hook(void *arg, void *cbdata, isc_result_t *resp) {
 	return NS_HOOK_RETURN;
 }
 
-static cfg_clausedef_t syncplugin__cfgclauses[] = {
+static cfg_clausedef_external_t syncplugin__cfgclauses[] = {
 	{ "rcode", &cfg_type_astring, 0, NULL },
 	{ "source", &cfg_type_astring, 0, NULL },
 	{ "firstlbl", &cfg_type_qstring, CFG_CLAUSEFLAG_OPTIONAL, NULL }
 };
 
-static cfg_clausedef_t *syncplugin__cfgparamsclausesets[] = {
+static cfg_clausedef_external_t *syncplugin__cfgparamsclausesets[] = {
 	syncplugin__cfgclauses, NULL
 };
 
diff --git a/lib/isc/symtab.c b/lib/isc/symtab.c
index fcd192be60f..3bb0465e19d 100644
--- a/lib/isc/symtab.c
+++ b/lib/isc/symtab.c
@@ -141,7 +141,8 @@ static inline uint32_t
 elt_hash(elt_t *restrict elt, bool case_sensitive) {
 	const uint8_t *ptr = elt->key;
 	size_t len = elt->size;
-	return fx_hash_bytes(0, ptr, len, case_sensitive);
+	return fx_add_to_hash(fx_hash_bytes(0, ptr, len, case_sensitive),
+			      elt->type);
 }
 
 isc_result_t
diff --git a/lib/isccfg/aclconf.c b/lib/isccfg/aclconf.c
index cea7a84328e..c1a223610e0 100644
--- a/lib/isccfg/aclconf.c
+++ b/lib/isccfg/aclconf.c
@@ -24,6 +24,7 @@
 #include <dns/fixedname.h>
 #include <dns/iptable.h>
 
+#include <isccfg/clause.h>
 #include <isccfg/aclconf.h>
 #include <isccfg/namedconf.h>
 
@@ -77,7 +78,7 @@ static isc_result_t
 get_acl_def(const cfg_obj_t *cctx, const char *name, const cfg_obj_t **ret) {
 	const cfg_obj_t *acls = NULL;
 
-	RETERR(cfg_map_get(cctx, "acl", &acls));
+	RETERR(cfg_map_get(cctx, CFG_CLAUSE_ACL, &acls));
 	CFG_LIST_FOREACH(acls, elt) {
 		const cfg_obj_t *acl = cfg_listelt_value(elt);
 		const char *aclname =
diff --git a/lib/isccfg/check.c b/lib/isccfg/check.c
index 6596b506371..1496cd1bb7e 100644
--- a/lib/isccfg/check.c
+++ b/lib/isccfg/check.c
@@ -60,6 +60,7 @@
 
 #include <dst/dst.h>
 
+#include <isccfg/clause.h>
 #include <isccfg/aclconf.h>
 #include <isccfg/cfg.h>
 #include <isccfg/check.h>
@@ -189,7 +190,7 @@ check_order(const cfg_obj_t *options) {
 	isc_result_t tresult;
 	const cfg_obj_t *obj = NULL;
 
-	if (cfg_map_get(options, "rrset-order", &obj) != ISC_R_SUCCESS) {
+	if (cfg_map_get(options, CFG_CLAUSE_RRSET_ORDER, &obj) != ISC_R_SUCCESS) {
 		return result;
 	}
 
@@ -214,7 +215,7 @@ check_dual_stack(const cfg_obj_t *options) {
 	isc_result_t result = ISC_R_SUCCESS;
 	isc_result_t tresult;
 
-	(void)cfg_map_get(options, "dual-stack-servers", &alternates);
+	(void)cfg_map_get(options, CFG_CLAUSE_DUAL_STACK_SERVERS, &alternates);
 
 	if (alternates == NULL) {
 		return ISC_R_SUCCESS;
@@ -297,8 +298,8 @@ check_forward(const cfg_obj_t *config, const cfg_obj_t *options,
 	const cfg_obj_t *forwarders = NULL;
 	const cfg_obj_t *faddresses = NULL;
 
-	(void)cfg_map_get(options, "forward", &forward);
-	(void)cfg_map_get(options, "forwarders", &forwarders);
+	(void)cfg_map_get(options, CFG_CLAUSE_FORWARD, &forward);
+	(void)cfg_map_get(options, CFG_CLAUSE_FORWARDERS, &forwarders);
 
 	if (forwarders != NULL && global != NULL) {
 		const char *file = cfg_obj_file(global);
@@ -465,7 +466,7 @@ checkacl(const char *aclname, cfg_aclconfctx_t *aclctx,
 	}
 	if (config != NULL && aclobj == NULL) {
 		options = NULL;
-		cfg_map_get(config, "options", &options);
+		cfg_map_get(config, CFG_CLAUSE_OPTIONS, &options);
 		if (options != NULL) {
 			cfg_map_get(options, aclname, &aclobj);
 		}
@@ -571,13 +572,13 @@ check_dns64(cfg_aclconfctx_t *aclctx, const cfg_obj_t *voptions,
 	static const char *acls[] = { "clients", "exclude", "mapped", NULL };
 
 	if (voptions != NULL) {
-		cfg_map_get(voptions, "dns64", &dns64);
+		cfg_map_get(voptions, CFG_CLAUSE_DNS64, &dns64);
 	}
 	if (config != NULL && dns64 == NULL) {
 		options = NULL;
-		cfg_map_get(config, "options", &options);
+		cfg_map_get(config, CFG_CLAUSE_OPTIONS, &options);
 		if (options != NULL) {
-			cfg_map_get(options, "dns64", &dns64);
+			cfg_map_get(options, CFG_CLAUSE_DNS64, &dns64);
 		}
 	}
 	if (dns64 == NULL) {
@@ -630,7 +631,7 @@ check_dns64(cfg_aclconfctx_t *aclctx, const cfg_obj_t *voptions,
 		}
 
 		obj = NULL;
-		(void)cfg_map_get(map, "suffix", &obj);
+		(void)cfg_map_get(map, CFG_CLAUSE_SUFFIX, &obj);
 		if (obj != NULL) {
 			static const unsigned char zeros[16];
 			isc_netaddr_fromsockaddr(&sa, cfg_obj_assockaddr(obj));
@@ -698,13 +699,13 @@ check_ratelimit(cfg_aclconfctx_t *aclctx, const cfg_obj_t *voptions,
 	int slip;
 
 	if (voptions != NULL) {
-		cfg_map_get(voptions, "rate-limit", &map);
+		cfg_map_get(voptions, CFG_CLAUSE_RATE_LIMIT, &map);
 	}
 	if (config != NULL && map == NULL) {
 		options = NULL;
-		cfg_map_get(config, "options", &options);
+		cfg_map_get(config, CFG_CLAUSE_OPTIONS, &options);
 		if (options != NULL) {
-			cfg_map_get(options, "rate-limit", &map);
+			cfg_map_get(options, CFG_CLAUSE_RATE_LIMIT, &map);
 		}
 	}
 	if (map == NULL) {
@@ -713,7 +714,7 @@ check_ratelimit(cfg_aclconfctx_t *aclctx, const cfg_obj_t *voptions,
 
 	min_entries = 500;
 	obj = NULL;
-	mresult = cfg_map_get(map, "min-table-size", &obj);
+	mresult = cfg_map_get(map, CFG_CLAUSE_MIN_TABLE_SIZE, &obj);
 	if (mresult == ISC_R_SUCCESS) {
 		min_entries = cfg_obj_asuint32(obj);
 		if (min_entries < 1) {
@@ -722,7 +723,7 @@ check_ratelimit(cfg_aclconfctx_t *aclctx, const cfg_obj_t *voptions,
 	}
 
 	obj = NULL;
-	mresult = cfg_map_get(map, "max-table-size", &obj);
+	mresult = cfg_map_get(map, CFG_CLAUSE_MAX_TABLE_SIZE, &obj);
 	if (mresult == ISC_R_SUCCESS) {
 		i = cfg_obj_asuint32(obj);
 		CHECK_RRL(i >= min_entries,
@@ -747,7 +748,7 @@ check_ratelimit(cfg_aclconfctx_t *aclctx, const cfg_obj_t *voptions,
 	CHECK_RRL_RATE(slip, 2, DNS_RRL_MAX_SLIP, "slip");
 
 	obj = NULL;
-	mresult = cfg_map_get(map, "window", &obj);
+	mresult = cfg_map_get(map, CFG_CLAUSE_WINDOW, &obj);
 	if (mresult == ISC_R_SUCCESS) {
 		i = cfg_obj_asuint32(obj);
 		CHECK_RRL(i >= 1 && i <= DNS_RRL_MAX_WINDOW,
@@ -755,14 +756,14 @@ check_ratelimit(cfg_aclconfctx_t *aclctx, const cfg_obj_t *voptions,
 	}
 
 	obj = NULL;
-	mresult = cfg_map_get(map, "qps-scale", &obj);
+	mresult = cfg_map_get(map, CFG_CLAUSE_QPS_SCALE, &obj);
 	if (mresult == ISC_R_SUCCESS) {
 		i = cfg_obj_asuint32(obj);
 		CHECK_RRL(i >= 1, "invalid 'qps-scale %d'%s", i, "");
 	}
 
 	obj = NULL;
-	mresult = cfg_map_get(map, "ipv4-prefix-length", &obj);
+	mresult = cfg_map_get(map, CFG_CLAUSE_IPV4_PREFIX_LENGTH, &obj);
 	if (mresult == ISC_R_SUCCESS) {
 		i = cfg_obj_asuint32(obj);
 		CHECK_RRL(i >= 8 && i <= 32,
@@ -770,7 +771,7 @@ check_ratelimit(cfg_aclconfctx_t *aclctx, const cfg_obj_t *voptions,
 	}
 
 	obj = NULL;
-	mresult = cfg_map_get(map, "ipv6-prefix-length", &obj);
+	mresult = cfg_map_get(map, CFG_CLAUSE_IPV6_PREFIX_LENGTH, &obj);
 	if (mresult == ISC_R_SUCCESS) {
 		i = cfg_obj_asuint32(obj);
 		CHECK_RRL(i >= 16 && i <= DNS_RRL_MAX_PREFIX,
@@ -779,7 +780,7 @@ check_ratelimit(cfg_aclconfctx_t *aclctx, const cfg_obj_t *voptions,
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(map, "exempt-clients", &obj);
+	(void)cfg_map_get(map, CFG_CLAUSE_EXEMPT_CLIENTS, &obj);
 	if (obj != NULL) {
 		dns_acl_t *acl = NULL;
 		isc_result_t tresult;
@@ -805,13 +806,13 @@ check_fetchlimit(const cfg_obj_t *voptions, const cfg_obj_t *config) {
 	double low, high, discount;
 
 	if (voptions != NULL) {
-		cfg_map_get(voptions, "fetch-quota-params", &map);
+		cfg_map_get(voptions, CFG_CLAUSE_FETCH_QUOTA_PARAMS, &map);
 	}
 	if (config != NULL && map == NULL) {
 		options = NULL;
-		cfg_map_get(config, "options", &options);
+		cfg_map_get(config, CFG_CLAUSE_OPTIONS, &options);
 		if (options != NULL) {
-			cfg_map_get(options, "fetch-quota-params", &map);
+			cfg_map_get(options, CFG_CLAUSE_FETCH_QUOTA_PARAMS, &map);
 		}
 	}
 	if (map == NULL) {
@@ -870,13 +871,13 @@ check_recursionacls(cfg_aclconfctx_t *aclctx, const cfg_obj_t *voptions,
 				      NULL };
 
 	if (voptions != NULL) {
-		cfg_map_get(voptions, "recursion", &obj);
+		cfg_map_get(voptions, CFG_CLAUSE_RECURSION, &obj);
 	}
 	if (obj == NULL && config != NULL) {
 		options = NULL;
-		cfg_map_get(config, "options", &options);
+		cfg_map_get(config, CFG_CLAUSE_OPTIONS, &options);
 		if (options != NULL) {
-			cfg_map_get(options, "recursion", &obj);
+			cfg_map_get(options, CFG_CLAUSE_RECURSION, &obj);
 		}
 	}
 	if (obj == NULL) {
@@ -899,7 +900,7 @@ check_recursionacls(cfg_aclconfctx_t *aclctx, const cfg_obj_t *voptions,
 		}
 		if (config != NULL && aclobj == NULL) {
 			options = NULL;
-			cfg_map_get(config, "options", &options);
+			cfg_map_get(config, CFG_CLAUSE_OPTIONS, &options);
 			if (options != NULL) {
 				cfg_map_get(options, acls[i], &aclobj);
 			}
@@ -1316,7 +1317,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	ISC_LIST_INIT(kslist);
 
 	obj = NULL;
-	(void)cfg_map_get(options, "key-store", &obj);
+	(void)cfg_map_get(options, CFG_CLAUSE_KEY_STORE, &obj);
 	if (obj != NULL) {
 		if (optlevel != optlevel_config) {
 			cfg_obj_log(obj, ISC_LOG_ERROR,
@@ -1348,7 +1349,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 				}
 
 				kopt = cfg_tuple_get(kconfig, "options");
-				if (cfg_map_get(kopt, "directory", &kobj) ==
+				if (cfg_map_get(kopt, CFG_CLAUSE_DIRECTORY, &kobj) ==
 				    ISC_R_SUCCESS)
 				{
 					val = cfg_obj_asstring(kobj);
@@ -1409,7 +1410,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	 * Check dnssec-policy.
 	 */
 	obj = NULL;
-	(void)cfg_map_get(options, "dnssec-policy", &obj);
+	(void)cfg_map_get(options, CFG_CLAUSE_DNSSEC_POLICY, &obj);
 	if (obj != NULL) {
 		bool bad_kasp = false;
 		bool bad_name = false;
@@ -1494,7 +1495,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	 * Other checks.
 	 */
 	obj = NULL;
-	cfg_map_get(options, "max-rsa-exponent-size", &obj);
+	cfg_map_get(options, CFG_CLAUSE_MAX_RSA_EXPONENT_SIZE, &obj);
 	if (obj != NULL) {
 		uint32_t val;
 
@@ -1509,7 +1510,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(options, "preferred-glue", &obj);
+	(void)cfg_map_get(options, CFG_CLAUSE_PREFERRED_GLUE, &obj);
 	if (obj != NULL) {
 		str = cfg_obj_asstring(obj);
 		if (strcasecmp(str, "a") != 0 && strcasecmp(str, "aaaa") != 0 &&
@@ -1525,7 +1526,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	 * Set supported DNSSEC algorithms.
 	 */
 	obj = NULL;
-	(void)cfg_map_get(options, "disable-algorithms", &obj);
+	(void)cfg_map_get(options, CFG_CLAUSE_DISABLE_ALGORITHMS, &obj);
 	if (obj != NULL) {
 		CFG_LIST_FOREACH(obj, element) {
 			obj = cfg_listelt_value(element);
@@ -1540,7 +1541,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	 * Set supported DS digest types.
 	 */
 	obj = NULL;
-	(void)cfg_map_get(options, "disable-ds-digests", &obj);
+	(void)cfg_map_get(options, CFG_CLAUSE_DISABLE_DS_DIGESTS, &obj);
 	if (obj != NULL) {
 		CFG_LIST_FOREACH(obj, element) {
 			obj = cfg_listelt_value(element);
@@ -1557,7 +1558,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	 */
 	if (optlevel != optlevel_zone) {
 		obj = NULL;
-		(void)cfg_map_get(options, "send-report-channel", &obj);
+		(void)cfg_map_get(options, CFG_CLAUSE_SEND_REPORT_CHANNEL, &obj);
 		if (obj != NULL) {
 			str = cfg_obj_asstring(obj);
 			tresult = check_name(str);
@@ -1594,7 +1595,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	 * Check empty zone configuration.
 	 */
 	obj = NULL;
-	(void)cfg_map_get(options, "disable-empty-zone", &obj);
+	(void)cfg_map_get(options, CFG_CLAUSE_DISABLE_EMPTY_ZONE, &obj);
 	CFG_LIST_FOREACH(obj, element) {
 		obj = cfg_listelt_value(element);
 		str = cfg_obj_asstring(obj);
@@ -1613,7 +1614,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	 * 1024 bytes should be big enough.
 	 */
 	obj = NULL;
-	(void)cfg_map_get(options, "server-id", &obj);
+	(void)cfg_map_get(options, CFG_CLAUSE_SERVER_ID, &obj);
 	if (obj != NULL && cfg_obj_isstring(obj) &&
 	    strlen(cfg_obj_asstring(obj)) > 1024U)
 	{
@@ -1625,7 +1626,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(options, "nta-lifetime", &obj);
+	(void)cfg_map_get(options, CFG_CLAUSE_NTA_LIFETIME, &obj);
 	if (obj != NULL) {
 		lifetime = cfg_obj_asduration(obj);
 		if (lifetime > 604800) { /* 7 days */
@@ -1644,7 +1645,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(options, "nta-recheck", &obj);
+	(void)cfg_map_get(options, CFG_CLAUSE_NTA_RECHECK, &obj);
 	if (obj != NULL) {
 		uint32_t recheck = cfg_obj_asduration(obj);
 		if (recheck > 604800) { /* 7 days */
@@ -1665,7 +1666,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(options, "cookie-algorithm", &obj);
+	(void)cfg_map_get(options, CFG_CLAUSE_COOKIE_ALGORITHM, &obj);
 	if (obj != NULL) {
 		ccalg = cfg_obj_asstring(obj);
 		if (strcasecmp(ccalg, "aes") == 0) {
@@ -1679,7 +1680,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(options, "cookie-secret", &obj);
+	(void)cfg_map_get(options, CFG_CLAUSE_COOKIE_SECRET, &obj);
 	if (obj != NULL) {
 		unsigned char secret[32];
 
@@ -1774,7 +1775,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 
 	/* Check that dnstap-ouput values are consistent */
 	obj = NULL;
-	(void)cfg_map_get(options, "dnstap-output", &obj);
+	(void)cfg_map_get(options, CFG_CLAUSE_DNSTAP_OUTPUT, &obj);
 	if (obj != NULL) {
 		const cfg_obj_t *obj2;
 		dns_dtmode_t dmode;
@@ -1833,7 +1834,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 #endif /* ifdef HAVE_DNSTAP */
 
 	obj = NULL;
-	(void)cfg_map_get(options, "lmdb-mapsize", &obj);
+	(void)cfg_map_get(options, CFG_CLAUSE_LMDB_MAPSIZE, &obj);
 	if (obj != NULL) {
 		uint64_t mapsize = cfg_obj_asuint64(obj);
 
@@ -1859,7 +1860,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(options, "max-ixfr-ratio", &obj);
+	(void)cfg_map_get(options, CFG_CLAUSE_MAX_IXFR_RATIO, &obj);
 	if (obj != NULL && cfg_obj_ispercentage(obj)) {
 		uint32_t percent = cfg_obj_aspercentage(obj);
 		if (percent == 0) {
@@ -1877,7 +1878,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(options, "check-names", &obj);
+	(void)cfg_map_get(options, CFG_CLAUSE_CHECK_NAMES, &obj);
 	if (obj != NULL && !cfg_obj_islist(obj)) {
 		obj = NULL;
 	}
@@ -1951,7 +1952,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(options, "stale-refresh-time", &obj);
+	(void)cfg_map_get(options, CFG_CLAUSE_STALE_REFRESH_TIME, &obj);
 	if (obj != NULL) {
 		uint32_t refresh_time = cfg_obj_asduration(obj);
 		if (refresh_time > 0 && refresh_time < 30) {
@@ -1964,7 +1965,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	cfg_aclconfctx_create(mctx, &aclctx);
 
 	obj = NULL;
-	(void)cfg_map_get(options, "sig0checks-quota-exempt", &obj);
+	(void)cfg_map_get(options, CFG_CLAUSE_SIG0CHECKS_QUOTA_EXEMPT, &obj);
 	if (obj != NULL) {
 		dns_acl_t *acl = NULL;
 
@@ -1979,7 +1980,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(options, "listen-on", &obj);
+	(void)cfg_map_get(options, CFG_CLAUSE_LISTEN_ON, &obj);
 	if (obj != NULL) {
 		INSIST(config != NULL);
 		tresult = check_listeners(obj, config, aclctx, mctx);
@@ -1989,7 +1990,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	}
 
 	obj = NULL;
-	(void)cfg_map_get(options, "listen-on-v6", &obj);
+	(void)cfg_map_get(options, CFG_CLAUSE_LISTEN_ON_V6, &obj);
 	if (obj != NULL) {
 		INSIST(config != NULL);
 		tresult = check_listeners(obj, config, aclctx, mctx);
@@ -2001,7 +2002,7 @@ check_options(const cfg_obj_t *options, const cfg_obj_t *config,
 	check_range_uint32(options, &result, "max-query-restarts", 1, 255);
 
 	obj = NULL;
-	(void)cfg_map_get(options, "prefetch", &obj);
+	(void)cfg_map_get(options, CFG_CLAUSE_PREFETCH, &obj);
 	if (obj != NULL) {
 		const cfg_obj_t *trigger = cfg_tuple_get(obj, "trigger");
 		const cfg_obj_t *eligible = cfg_tuple_get(obj, "eligible");
@@ -2171,7 +2172,7 @@ check_httpserver(const cfg_obj_t *http, isc_symtab_t *symtab) {
 	}
 
 	/* Check endpoints are valid */
-	tresult = cfg_map_get(http, "endpoints", &eps);
+	tresult = cfg_map_get(http, CFG_CLAUSE_ENDPOINTS, &eps);
 	if (tresult == ISC_R_SUCCESS) {
 		CFG_LIST_FOREACH(eps, elt) {
 			const cfg_obj_t *ep = cfg_listelt_value(elt);
@@ -2199,7 +2200,7 @@ check_httpservers(const cfg_obj_t *config, isc_mem_t *mctx) {
 
 	isc_symtab_create(mctx, NULL, NULL, false, &symtab);
 
-	result = cfg_map_get(config, "http", &obj);
+	result = cfg_map_get(config, CFG_CLAUSE_HTTP, &obj);
 	if (result != ISC_R_SUCCESS) {
 		result = ISC_R_SUCCESS;
 		goto done;
@@ -2260,8 +2261,8 @@ check_tls_defintion(const cfg_obj_t *tlsobj, const char *name,
 		}
 	}
 
-	(void)cfg_map_get(tlsobj, "key-file", &tls_key);
-	(void)cfg_map_get(tlsobj, "cert-file", &tls_cert);
+	(void)cfg_map_get(tlsobj, CFG_CLAUSE_KEY_FILE, &tls_key);
+	(void)cfg_map_get(tlsobj, CFG_CLAUSE_CERT_FILE, &tls_cert);
 	if ((tls_key == NULL && tls_cert != NULL) ||
 	    (tls_cert == NULL && tls_key != NULL))
 	{
@@ -2273,7 +2274,7 @@ check_tls_defintion(const cfg_obj_t *tlsobj, const char *name,
 	}
 
 	/* Check protocols are valid */
-	tresult = cfg_map_get(tlsobj, "protocols", &tls_proto_list);
+	tresult = cfg_map_get(tlsobj, CFG_CLAUSE_PROTOCOLS, &tls_proto_list);
 	if (tresult == ISC_R_SUCCESS) {
 		INSIST(tls_proto_list != NULL);
 		CFG_LIST_FOREACH(tls_proto_list, proto) {
@@ -2321,7 +2322,7 @@ check_tls_defintion(const cfg_obj_t *tlsobj, const char *name,
 	}
 
 	/* Check cipher list string is valid */
-	tresult = cfg_map_get(tlsobj, "ciphers", &tls_ciphers);
+	tresult = cfg_map_get(tlsobj, CFG_CLAUSE_CIPHERS, &tls_ciphers);
 	if (tresult == ISC_R_SUCCESS) {
 		const char *ciphers = cfg_obj_asstring(tls_ciphers);
 		if (!isc_tls_cipherlist_valid(ciphers)) {
@@ -2335,7 +2336,7 @@ check_tls_defintion(const cfg_obj_t *tlsobj, const char *name,
 	}
 
 	/* Check if the cipher suites string is valid */
-	tresult = cfg_map_get(tlsobj, "cipher-suites", &tls_cipher_suites);
+	tresult = cfg_map_get(tlsobj, CFG_CLAUSE_CIPHER_SUITES, &tls_cipher_suites);
 	if (tresult == ISC_R_SUCCESS) {
 		const char *cipher_suites = cfg_obj_asstring(tls_cipher_suites);
 		if (!isc_tls_cipher_suites_valid(cipher_suites)) {
@@ -2357,7 +2358,7 @@ check_tls_definitions(const cfg_obj_t *config, isc_mem_t *mctx) {
 	const cfg_obj_t *obj = NULL;
 	isc_symtab_t *symtab = NULL;
 
-	result = cfg_map_get(config, "tls", &obj);
+	result = cfg_map_get(config, CFG_CLAUSE_TLS, &obj);
 	if (result != ISC_R_SUCCESS) {
 		result = ISC_R_SUCCESS;
 		return result;
@@ -2430,7 +2431,7 @@ lookup_key(const cfg_obj_t *config, const dns_name_t *keyname) {
 		return false;
 	}
 
-	(void)cfg_map_get(config, "key", &keys);
+	(void)cfg_map_get(config, CFG_CLAUSE_KEY, &keys);
 	CFG_LIST_FOREACH(keys, elt) {
 		/*
 		 * `key` are normalized TSIG which must be identified by
@@ -2821,7 +2822,7 @@ check_mirror_zone_notify(const cfg_obj_t *zoptions, const char *znamestr) {
 	bool notify_configuration_ok = true;
 	const cfg_obj_t *obj = NULL;
 
-	(void)cfg_map_get(zoptions, "notify", &obj);
+	(void)cfg_map_get(zoptions, CFG_CLAUSE_NOTIFY, &obj);
 	if (obj == NULL) {
 		/*
 		 * "notify" not set at zone level.  This is fine.
@@ -2879,10 +2880,10 @@ check_recursion(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	obj = NULL;
 	result = ISC_R_NOTFOUND;
 	if (voptions != NULL) {
-		result = cfg_map_get(voptions, "recursion", &obj);
+		result = cfg_map_get(voptions, CFG_CLAUSE_RECURSION, &obj);
 	}
 	if (result != ISC_R_SUCCESS && goptions != NULL) {
-		result = cfg_map_get(goptions, "recursion", &obj);
+		result = cfg_map_get(goptions, CFG_CLAUSE_RECURSION, &obj);
 	}
 	if (result == ISC_R_SUCCESS && !cfg_obj_asboolean(obj)) {
 		retval = false;
@@ -2896,10 +2897,10 @@ check_recursion(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	obj = NULL;
 	result = ISC_R_NOTFOUND;
 	if (voptions != NULL) {
-		result = cfg_map_get(voptions, "allow-recursion", &obj);
+		result = cfg_map_get(voptions, CFG_CLAUSE_ALLOW_RECURSION, &obj);
 	}
 	if (result != ISC_R_SUCCESS && goptions != NULL) {
-		result = cfg_map_get(goptions, "allow-recursion", &obj);
+		result = cfg_map_get(goptions, CFG_CLAUSE_ALLOW_RECURSION, &obj);
 	}
 	if (result == ISC_R_SUCCESS) {
 		CHECK(cfg_acl_fromconfig(obj, config, aclctx, mctx, 0, &acl));
@@ -2936,8 +2937,8 @@ check_keydir(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 	timenow = isc_time_now();
 	now = isc_time_seconds(&timenow);
 
-	(void)cfg_map_get(config, "dnssec-policy", &kasps);
-	(void)cfg_map_get(config, "key-store", &keystores);
+	(void)cfg_map_get(config, CFG_CLAUSE_DNSSEC_POLICY, &kasps);
+	(void)cfg_map_get(config, CFG_CLAUSE_KEY_STORE, &keystores);
 	ISC_LIST_INIT(kasplist);
 	ISC_LIST_INIT(kslist);
 
@@ -3298,12 +3299,12 @@ isccfg_check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	zoptions = cfg_tuple_get(zconfig, "options");
 
 	if (config != NULL) {
-		cfg_map_get(config, "options", &goptions);
+		cfg_map_get(config, CFG_CLAUSE_OPTIONS, &goptions);
 	}
 
 	/* If the zone specifies a template, find it too */
-	(void)cfg_map_get(config, "template", &templates);
-	(void)cfg_map_get(zoptions, "template", &obj);
+	(void)cfg_map_get(config, CFG_CLAUSE_TEMPLATE, &templates);
+	(void)cfg_map_get(zoptions, CFG_CLAUSE_TEMPLATE, &obj);
 	if (obj != NULL) {
 		tmplname = cfg_obj_asstring(obj);
 
@@ -3325,7 +3326,7 @@ isccfg_check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		}
 	}
 
-	(void)cfg_map_get(zoptions, "in-view", &inviewobj);
+	(void)cfg_map_get(zoptions, CFG_CLAUSE_IN_VIEW, &inviewobj);
 	if (inviewobj != NULL) {
 		target = cfg_obj_asstring(inviewobj);
 		ztype = CFG_ZONE_INVIEW;
@@ -3491,12 +3492,12 @@ isccfg_check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		const cfg_obj_t *fwd = NULL;
 		unsigned int maxopts = 1;
 
-		(void)cfg_map_get(zoptions, "forward", &fwd);
+		(void)cfg_map_get(zoptions, CFG_CLAUSE_FORWARD, &fwd);
 		if (fwd != NULL) {
 			maxopts++;
 		}
 		fwd = NULL;
-		(void)cfg_map_get(zoptions, "forwarders", &fwd);
+		(void)cfg_map_get(zoptions, CFG_CLAUSE_FORWARDERS, &fwd);
 		if (fwd != NULL) {
 			maxopts++;
 		}
@@ -3538,7 +3539,7 @@ isccfg_check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 			kasp_inlinesigning = false;
 		} else {
 			const cfg_obj_t *kasps = NULL;
-			(void)cfg_map_get(config, "dnssec-policy", &kasps);
+			(void)cfg_map_get(config, CFG_CLAUSE_DNSSEC_POLICY, &kasps);
 			CFG_LIST_FOREACH(kasps, element) {
 				const cfg_obj_t *kobj = cfg_tuple_get(
 					cfg_listelt_value(element), "name");
@@ -3549,7 +3550,7 @@ isccfg_check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 					const cfg_obj_t *kopt = cfg_tuple_get(
 						cfg_listelt_value(element),
 						"options");
-					if (cfg_map_get(kopt, "inline-signing",
+					if (cfg_map_get(kopt, CFG_CLAUSE_INLINE_SIGNING,
 							&inlinesigning) ==
 					    ISC_R_SUCCESS)
 					{
@@ -4277,7 +4278,7 @@ isccfg_check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	if ((flags & BIND_CHECK_PLUGINS) != 0 && zoptions != NULL) {
 		const cfg_obj_t *plugins = NULL;
 
-		(void)cfg_map_get(zoptions, "plugin", &plugins);
+		(void)cfg_map_get(zoptions, CFG_CLAUSE_PLUGIN, &plugins);
 		tresult = check_plugins(plugins, config, aclctx, zname, mctx);
 		if (tresult != ISC_R_SUCCESS) {
 			result = tresult;
@@ -4315,8 +4316,8 @@ isccfg_check_key(const cfg_obj_t *key) {
 		{ NULL, 0 }
 	};
 
-	(void)cfg_map_get(key, "algorithm", &algobj);
-	(void)cfg_map_get(key, "secret", &secretobj);
+	(void)cfg_map_get(key, CFG_CLAUSE_ALGORITHM, &algobj);
+	(void)cfg_map_get(key, CFG_CLAUSE_SECRET, &secretobj);
 	if (secretobj == NULL || algobj == NULL) {
 		cfg_obj_log(key, ISC_LOG_ERROR,
 			    "key '%s' must have both 'secret' and "
@@ -4650,10 +4651,10 @@ check_servers(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	dns_name_t *keyname = NULL;
 	servers = NULL;
 	if (voptions != NULL) {
-		(void)cfg_map_get(voptions, "server", &servers);
+		(void)cfg_map_get(voptions, CFG_CLAUSE_SERVER, &servers);
 	}
 	if (servers == NULL) {
-		(void)cfg_map_get(config, "server", &servers);
+		(void)cfg_map_get(config, CFG_CLAUSE_SERVER, &servers);
 	}
 	if (servers == NULL) {
 		return ISC_R_SUCCESS;
@@ -4764,7 +4765,7 @@ check_servers(const cfg_obj_t *config, const cfg_obj_t *voptions,
 		}
 
 		keys = NULL;
-		cfg_map_get(v1, "keys", &keys);
+		cfg_map_get(v1, CFG_CLAUSE_KEYS, &keys);
 		if (keys != NULL) {
 			/*
 			 * Normalize key name.
@@ -5410,7 +5411,7 @@ check_rpz_catz(const char *rpz_catz, const cfg_obj_t *rpz_obj,
 				zoneobj = cfg_tuple_get(zoneobj, "options");
 			}
 			if (zoneobj != NULL && cfg_obj_ismap(zoneobj)) {
-				(void)cfg_map_get(zoneobj, "type", &obj);
+				(void)cfg_map_get(zoneobj, CFG_CLAUSE_TYPE, &obj);
 			}
 			if (obj != NULL) {
 				zonetype = cfg_obj_asstring(obj);
@@ -5552,17 +5553,17 @@ check_dnstap(const cfg_obj_t *voptions, const cfg_obj_t *config) {
 	const cfg_obj_t *obj = NULL;
 
 	if (config != NULL) {
-		(void)cfg_map_get(config, "options", &options);
+		(void)cfg_map_get(config, CFG_CLAUSE_OPTIONS, &options);
 	}
 	if (options != NULL) {
-		(void)cfg_map_get(options, "dnstap-output", &obj);
+		(void)cfg_map_get(options, CFG_CLAUSE_DNSTAP_OUTPUT, &obj);
 	}
 	if (obj == NULL) {
 		if (voptions != NULL) {
-			(void)cfg_map_get(voptions, "dnstap", &obj);
+			(void)cfg_map_get(voptions, CFG_CLAUSE_DNSTAP, &obj);
 		}
 		if (options != NULL && obj == NULL) {
-			(void)cfg_map_get(options, "dnstap", &obj);
+			(void)cfg_map_get(options, CFG_CLAUSE_DNSTAP, &obj);
 		}
 		if (obj != NULL) {
 			cfg_obj_log(obj, ISC_LOG_ERROR,
@@ -5604,7 +5605,7 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	/*
 	 * Get global options block
 	 */
-	(void)cfg_map_get(config, "options", &options);
+	(void)cfg_map_get(config, CFG_CLAUSE_OPTIONS, &options);
 
 	/*
 	 * The most relevant options for this view
@@ -5624,9 +5625,9 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	cfg_aclconfctx_create(mctx, &aclctx);
 
 	if (voptions != NULL) {
-		(void)cfg_map_get(voptions, "zone", &zones);
+		(void)cfg_map_get(voptions, CFG_CLAUSE_ZONE, &zones);
 	} else {
-		(void)cfg_map_get(config, "zone", &zones);
+		(void)cfg_map_get(config, CFG_CLAUSE_ZONE, &zones);
 	}
 
 	CFG_LIST_FOREACH(zones, element) {
@@ -5646,7 +5647,7 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	 */
 	if (opts != NULL) {
 		obj = NULL;
-		if ((cfg_map_get(opts, "response-policy", &obj) ==
+		if ((cfg_map_get(opts, CFG_CLAUSE_RESPONSE_POLICY, &obj) ==
 		     ISC_R_SUCCESS) &&
 		    (check_rpz_catz("response-policy zone", obj, viewname,
 				    symtab,
@@ -5656,7 +5657,7 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 		}
 
 		obj = NULL;
-		if ((cfg_map_get(opts, "catalog-zones", &obj) ==
+		if ((cfg_map_get(opts, CFG_CLAUSE_CATALOG_ZONES, &obj) ==
 		     ISC_R_SUCCESS) &&
 		    (check_rpz_catz("catalog zone", obj, viewname, symtab,
 
@@ -5671,7 +5672,7 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	 */
 	if (opts != NULL) {
 		obj = NULL;
-		if ((cfg_map_get(opts, "response-policy", &obj) ==
+		if ((cfg_map_get(opts, CFG_CLAUSE_RESPONSE_POLICY, &obj) ==
 		     ISC_R_SUCCESS) &&
 		    (check_rpz(obj) != ISC_R_SUCCESS))
 		{
@@ -5684,7 +5685,7 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	 */
 	if (opts != NULL) {
 		obj = NULL;
-		if (cfg_map_get(opts, "catalog-zones", &obj) == ISC_R_SUCCESS) {
+		if (cfg_map_get(opts, CFG_CLAUSE_CATALOG_ZONES, &obj) == ISC_R_SUCCESS) {
 			if (vclass != dns_rdataclass_in) {
 				cfg_obj_log(
 					obj, ISC_LOG_ERROR,
@@ -5742,7 +5743,7 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	 */
 	isc_symtab_create(mctx, freekey, mctx, false, &symtab);
 
-	(void)cfg_map_get(config, "key", &keys);
+	(void)cfg_map_get(config, CFG_CLAUSE_KEY, &keys);
 	tresult = check_keylist(keys, symtab, mctx);
 	if (tresult == ISC_R_EXISTS) {
 		result = ISC_R_FAILURE;
@@ -5753,7 +5754,7 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 
 	if (voptions != NULL) {
 		keys = NULL;
-		(void)cfg_map_get(voptions, "key", &keys);
+		(void)cfg_map_get(voptions, CFG_CLAUSE_KEY, &keys);
 		tresult = check_keylist(keys, symtab, mctx);
 		if (tresult == ISC_R_EXISTS) {
 			result = ISC_R_FAILURE;
@@ -5776,9 +5777,9 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 	 * Load all DNSSEC keys.
 	 */
 	if (voptions != NULL) {
-		(void)cfg_map_get(voptions, "trust-anchors", &view_ta);
+		(void)cfg_map_get(voptions, CFG_CLAUSE_TRUST_ANCHORS, &view_ta);
 	}
-	(void)cfg_map_get(config, "trust-anchors", &global_ta);
+	(void)cfg_map_get(config, CFG_CLAUSE_TRUST_ANCHORS, &global_ta);
 
 	check_keys[0] = view_ta;
 	check_keys[1] = global_ta;
@@ -5830,10 +5831,10 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 
 	obj = NULL;
 	if (voptions != NULL) {
-		(void)cfg_map_get(voptions, "dnssec-validation", &obj);
+		(void)cfg_map_get(voptions, CFG_CLAUSE_DNSSEC_VALIDATION, &obj);
 	}
 	if (obj == NULL && options != NULL) {
-		(void)cfg_map_get(options, "dnssec-validation", &obj);
+		(void)cfg_map_get(options, CFG_CLAUSE_DNSSEC_VALIDATION, &obj);
 	}
 	if (obj != NULL) {
 		if (!cfg_obj_isboolean(obj)) {
@@ -5903,9 +5904,9 @@ check_viewconf(const cfg_obj_t *config, const cfg_obj_t *voptions,
 		const cfg_obj_t *plugins = NULL;
 
 		if (voptions != NULL) {
-			(void)cfg_map_get(voptions, "plugin", &plugins);
+			(void)cfg_map_get(voptions, CFG_CLAUSE_PLUGIN, &plugins);
 		} else {
-			(void)cfg_map_get(config, "plugin", &plugins);
+			(void)cfg_map_get(config, CFG_CLAUSE_PLUGIN, &plugins);
 		}
 
 		tresult = check_plugins(plugins, config, aclctx, NULL, mctx);
@@ -5947,7 +5948,7 @@ check_logging(const cfg_obj_t *config, isc_mem_t *mctx) {
 	isc_symvalue_t symvalue;
 	int i;
 
-	(void)cfg_map_get(config, "logging", &logobj);
+	(void)cfg_map_get(config, CFG_CLAUSE_LOGGING, &logobj);
 	if (logobj == NULL) {
 		return ISC_R_SUCCESS;
 	}
@@ -5961,16 +5962,16 @@ check_logging(const cfg_obj_t *config, isc_mem_t *mctx) {
 		RUNTIME_CHECK(tresult == ISC_R_SUCCESS);
 	}
 
-	cfg_map_get(logobj, "channel", &channels);
+	cfg_map_get(logobj, CFG_CLAUSE_CHANNEL, &channels);
 
 	CFG_LIST_FOREACH(channels, element) {
 		channel = cfg_listelt_value(element);
 		channelname = cfg_obj_asstring(cfg_map_getname(channel));
 		fileobj = syslogobj = nullobj = stderrobj = NULL;
-		(void)cfg_map_get(channel, "file", &fileobj);
-		(void)cfg_map_get(channel, "syslog", &syslogobj);
-		(void)cfg_map_get(channel, "null", &nullobj);
-		(void)cfg_map_get(channel, "stderr", &stderrobj);
+		(void)cfg_map_get(channel, CFG_CLAUSE_FILE, &fileobj);
+		(void)cfg_map_get(channel, CFG_CLAUSE_SYSLOG, &syslogobj);
+		(void)cfg_map_get(channel, CFG_CLAUSE_NULL, &nullobj);
+		(void)cfg_map_get(channel, CFG_CLAUSE_STDERR, &stderrobj);
 		i = 0;
 		if (fileobj != NULL) {
 			i++;
@@ -5997,7 +5998,7 @@ check_logging(const cfg_obj_t *config, isc_mem_t *mctx) {
 		RUNTIME_CHECK(tresult == ISC_R_SUCCESS);
 	}
 
-	cfg_map_get(logobj, "category", &categories);
+	cfg_map_get(logobj, CFG_CLAUSE_CATEGORY, &categories);
 
 	CFG_LIST_FOREACH(categories, element) {
 		category = cfg_listelt_value(element);
@@ -6067,12 +6068,12 @@ check_controls(const cfg_obj_t *config, isc_mem_t *mctx) {
 	dns_acl_t *acl = NULL;
 	isc_symtab_t *symtab = NULL;
 
-	(void)cfg_map_get(config, "controls", &controlslist);
+	(void)cfg_map_get(config, CFG_CLAUSE_CONTROLS, &controlslist);
 	if (controlslist == NULL) {
 		return ISC_R_SUCCESS;
 	}
 
-	(void)cfg_map_get(config, "key", &keylist);
+	(void)cfg_map_get(config, CFG_CLAUSE_KEY, &keylist);
 
 	cfg_aclconfctx_create(mctx, &aclctx);
 
@@ -6086,8 +6087,8 @@ check_controls(const cfg_obj_t *config, isc_mem_t *mctx) {
 		controls = cfg_listelt_value(element);
 		unixcontrols = NULL;
 		inetcontrols = NULL;
-		(void)cfg_map_get(controls, "unix", &unixcontrols);
-		(void)cfg_map_get(controls, "inet", &inetcontrols);
+		(void)cfg_map_get(controls, CFG_CLAUSE_UNIX, &unixcontrols);
+		(void)cfg_map_get(controls, CFG_CLAUSE_INET, &inetcontrols);
 		CFG_LIST_FOREACH(inetcontrols, element2) {
 			char socktext[ISC_SOCKADDR_FORMATSIZE];
 			isc_sockaddr_t addr;
@@ -6154,7 +6155,7 @@ isccfg_check_namedconf(const cfg_obj_t *config, unsigned int flags,
 	static const char *builtin[] = { "localhost", "localnets", "any",
 					 "none" };
 
-	(void)cfg_map_get(config, "options", &options);
+	(void)cfg_map_get(config, CFG_CLAUSE_OPTIONS, &options);
 
 	if (options != NULL &&
 	    check_options(options, config, check_algorithms, mctx,
@@ -6185,7 +6186,7 @@ isccfg_check_namedconf(const cfg_obj_t *config, unsigned int flags,
 		result = ISC_R_FAILURE;
 	}
 
-	(void)cfg_map_get(config, "view", &views);
+	(void)cfg_map_get(config, CFG_CLAUSE_VIEW, &views);
 
 	if (views != NULL && options != NULL) {
 		if (check_dual_stack(options) != ISC_R_SUCCESS) {
@@ -6219,7 +6220,7 @@ isccfg_check_namedconf(const cfg_obj_t *config, unsigned int flags,
 		const cfg_obj_t *zones = NULL;
 		const cfg_obj_t *plugins = NULL;
 
-		(void)cfg_map_get(config, "zone", &zones);
+		(void)cfg_map_get(config, CFG_CLAUSE_ZONE, &zones);
 		if (zones != NULL) {
 			cfg_obj_log(zones, ISC_LOG_ERROR,
 				    "when using 'view' statements, "
@@ -6227,7 +6228,7 @@ isccfg_check_namedconf(const cfg_obj_t *config, unsigned int flags,
 			result = ISC_R_FAILURE;
 		}
 
-		(void)cfg_map_get(config, "plugin", &plugins);
+		(void)cfg_map_get(config, CFG_CLAUSE_PLUGIN, &plugins);
 		if (plugins != NULL) {
 			cfg_obj_log(plugins, ISC_LOG_ERROR,
 				    "when using 'view' statements, "
@@ -6303,7 +6304,7 @@ isccfg_check_namedconf(const cfg_obj_t *config, unsigned int flags,
 		}
 	}
 
-	cfg_map_get(config, "acl", &acls);
+	cfg_map_get(config, CFG_CLAUSE_ACL, &acls);
 
 	if (acls != NULL) {
 		const char *aclname = NULL;
diff --git a/lib/isccfg/clause.c b/lib/isccfg/clause.c
new file mode 100644
index 00000000000..ca6c07bf315
--- /dev/null
+++ b/lib/isccfg/clause.c
@@ -0,0 +1,25 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#include <stddef.h>
+
+#include <isccfg/clause.h>
+
+/* clang-format off */
+const char *cfg_clause_as_string[] = {
+	[CFG_CLAUSE__NONE] = NULL,
+#define X(name, str) [name] = str,
+	CFG_CLAUSES
+#undef X
+};
+/* clang-format on */
diff --git a/lib/isccfg/include/isccfg/cfg.h b/lib/isccfg/include/isccfg/cfg.h
index 035dd2d0dfc..f94067b25f9 100644
--- a/lib/isccfg/include/isccfg/cfg.h
+++ b/lib/isccfg/include/isccfg/cfg.h
@@ -35,6 +35,8 @@
 #include <isc/refcount.h>
 #include <isc/types.h>
 
+#include <isccfg/clause.h>
+
 /***
  *** Types
  ***/
@@ -72,6 +74,11 @@ typedef struct cfg_listelt cfg_listelt_t;
  */
 typedef struct cfg_clausedef cfg_clausedef_t;
 
+/*%
+ * A configuration clause definition for external (plugin) maps.
+ */
+typedef struct cfg_clausedef_external cfg_clausedef_external_t;
+
 /*%
  * A callback function to be called when parsing an option
  * that needs to be interpreted at parsing time, like
@@ -204,14 +211,15 @@ cfg_obj_ispercentage(const cfg_obj_t *obj);
  */
 
 isc_result_t
-cfg_map_get(const cfg_obj_t *mapobj, const char *name, const cfg_obj_t **obj);
+cfg_map_get(const cfg_obj_t *mapobj, enum cfg_clause name,
+	    const cfg_obj_t **obj);
 /*%<
  * Extract an element from a configuration object, which
  * must be of a map type.
  *
  * Requires:
  * \li     'mapobj' points to a valid configuration object of a map type.
- * \li     'name' points to a null-terminated string.
+ * \li     'name' is a valid enum cfg_clause value.
  * \li	'obj' is non-NULL and '*obj' is NULL.
  *
  * Returns:
@@ -220,7 +228,7 @@ cfg_map_get(const cfg_obj_t *mapobj, const char *name, const cfg_obj_t **obj);
  */
 
 isc_result_t
-cfg_map_add(cfg_obj_t *mapobj, cfg_obj_t *obj, const char *clause);
+cfg_map_add(cfg_obj_t *mapobj, cfg_obj_t *obj, enum cfg_clause clause);
 /*%<
  * Add the object 'obj' to the specified clause in mapbody 'mapobj'.
  * Used for adding new zones.
@@ -578,7 +586,7 @@ cfg_map_nextclause(const cfg_type_t *map, const void **clauses,
 		   unsigned int *idx);
 
 const cfg_clausedef_t *
-cfg_map_findclause(const cfg_type_t *map, const char *name);
+cfg_map_findclause(const cfg_type_t *map, enum cfg_clause name);
 
 bool
 cfg_obj_ismap_external(const cfg_obj_t *obj);
@@ -601,17 +609,17 @@ cfg_map_external_add(cfg_obj_t *mapobj, cfg_obj_t *obj, const char *clause);
 
 isc_result_t
 cfg_map_external_addclone(cfg_obj_t *map, const cfg_obj_t *obj,
-			  const cfg_clausedef_t *clause);
+			  const cfg_clausedef_external_t *clause);
 
-const cfg_clausedef_t *
+const cfg_clausedef_external_t *
 cfg_map_external_firstclause(const cfg_type_t *map, const void **clauses,
 			     unsigned int *idx);
 
-const cfg_clausedef_t *
+const cfg_clausedef_external_t *
 cfg_map_external_nextclause(const cfg_type_t *map, const void **clauses,
 			    unsigned int *idx);
 
-const cfg_clausedef_t *
+const cfg_clausedef_external_t *
 cfg_map_external_findclause(const cfg_type_t *map, const char *name);
 
 typedef isc_result_t(pluginlist_cb_t)(
diff --git a/lib/isccfg/include/isccfg/clause.h b/lib/isccfg/include/isccfg/clause.h
new file mode 100644
index 00000000000..3fa5665e7fc
--- /dev/null
+++ b/lib/isccfg/include/isccfg/clause.h
@@ -0,0 +1,640 @@
+/*
+ * Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+ *
+ * SPDX-License-Identifier: MPL-2.0
+ *
+ * This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, you can obtain one at https://mozilla.org/MPL/2.0/.
+ *
+ * See the COPYRIGHT file distributed with this work for additional
+ * information regarding copyright ownership.
+ */
+
+#pragma once
+
+/*! \file isccfg/clause.h
+ * \brief
+ * Interned clause names for cfg_clausedef_t.
+ */
+
+/* clang-format off */
+
+#define CFG_CLAUSES \
+    X(CFG_CLAUSE_6TO4_SELF, "6to4-self") \
+    X(CFG_CLAUSE_ACACHE_CLEANING_INTERVAL, "acache-cleaning-interval") \
+    X(CFG_CLAUSE_ACACHE_ENABLE, "acache-enable") \
+    X(CFG_CLAUSE_ACL, "acl") \
+    X(CFG_CLAUSE_ADDITIONAL_FROM_AUTH, "additional-from-auth") \
+    X(CFG_CLAUSE_ADDITIONAL_FROM_CACHE, "additional-from-cache") \
+    X(CFG_CLAUSE_ADDRESS, "address") \
+    X(CFG_CLAUSE_ADDRESSES, "addresses") \
+    X(CFG_CLAUSE_ADD_SOA, "add-soa") \
+    X(CFG_CLAUSE_ADDZONECONF, "addzoneconf") \
+    X(CFG_CLAUSE_ALGORITHM, "algorithm") \
+    X(CFG_CLAUSE_ALGORITHMLIST, "algorithmlist") \
+    X(CFG_CLAUSE_ALGORITHMS, "algorithms") \
+    X(CFG_CLAUSE_ALL, "all") \
+    X(CFG_CLAUSE_ALLOW, "allow") \
+    X(CFG_CLAUSE_ALLOW_NEW_ZONES, "allow-new-zones") \
+    X(CFG_CLAUSE_ALLOW_NOTIFY, "allow-notify") \
+    X(CFG_CLAUSE_ALLOW_PROXY, "allow-proxy") \
+    X(CFG_CLAUSE_ALLOW_PROXY_ON, "allow-proxy-on") \
+    X(CFG_CLAUSE_ALLOW_QUERY, "allow-query") \
+    X(CFG_CLAUSE_ALLOW_QUERY_CACHE, "allow-query-cache") \
+    X(CFG_CLAUSE_ALLOW_QUERY_CACHE_ON, "allow-query-cache-on") \
+    X(CFG_CLAUSE_ALLOW_QUERY_ON, "allow-query-on") \
+    X(CFG_CLAUSE_ALLOW_RECURSION, "allow-recursion") \
+    X(CFG_CLAUSE_ALLOW_RECURSION_ON, "allow-recursion-on") \
+    X(CFG_CLAUSE_ALLOW_TRANSFER, "allow-transfer") \
+    X(CFG_CLAUSE_ALLOW_UPDATE, "allow-update") \
+    X(CFG_CLAUSE_ALLOW_UPDATE_FORWARDING, "allow-update-forwarding") \
+    X(CFG_CLAUSE_ALLOW_V6_SYNTHESIS, "allow-v6-synthesis") \
+    X(CFG_CLAUSE_ALL_PER_SECOND, "all-per-second") \
+    X(CFG_CLAUSE_ALSO_NOTIFY, "also-notify") \
+    X(CFG_CLAUSE_ALT_TRANSFER_SOURCE, "alt-transfer-source") \
+    X(CFG_CLAUSE_ALT_TRANSFER_SOURCE_V6, "alt-transfer-source-v6") \
+    X(CFG_CLAUSE_AML, "aml") \
+    X(CFG_CLAUSE_ANCHORTYPE, "anchortype") \
+    X(CFG_CLAUSE_ANSWER_COOKIE, "answer-cookie") \
+    X(CFG_CLAUSE_ATTACH_CACHE, "attach-cache") \
+    X(CFG_CLAUSE_AUTH_NXDOMAIN, "auth-nxdomain") \
+    X(CFG_CLAUSE_AUTO, "auto") \
+    X(CFG_CLAUSE_AUTO_DNSSEC, "auto-dnssec") \
+    X(CFG_CLAUSE_AUTOMATIC_INTERFACE_SCAN, "automatic-interface-scan") \
+    X(CFG_CLAUSE_AVOID_V4_UDP_PORTS, "avoid-v4-udp-ports") \
+    X(CFG_CLAUSE_AVOID_V6_UDP_PORTS, "avoid-v6-udp-ports") \
+    X(CFG_CLAUSE_BINDKEYS, "bindkeys") \
+    X(CFG_CLAUSE_BINDKEYS_FILE, "bindkeys-file") \
+    X(CFG_CLAUSE_BLACKHOLE, "blackhole") \
+    X(CFG_CLAUSE_BLOCK_SIZE, "block-size") \
+    X(CFG_CLAUSE_BLOCKSIZE, "blocksize") \
+    X(CFG_CLAUSE_BOGUS, "bogus") \
+    X(CFG_CLAUSE_BRACKETED_NETADDRLIST, "bracketed_netaddrlist") \
+    X(CFG_CLAUSE_BREAK_DNSSEC, "break-dnssec") \
+    X(CFG_CLAUSE_BUFFERED, "buffered") \
+    X(CFG_CLAUSE_BUILTIN_TRUST_ANCHORS, "builtin-trust-anchors") \
+    X(CFG_CLAUSE_CACHE_FILE, "cache-file") \
+    X(CFG_CLAUSE_CA_FILE, "ca-file") \
+    X(CFG_CLAUSE_CATALOG_ZONES, "catalog-zones") \
+    X(CFG_CLAUSE_CATEGORY, "category") \
+    X(CFG_CLAUSE_CDNSKEY, "cdnskey") \
+    X(CFG_CLAUSE_CDS_DIGEST_TYPES, "cds-digest-types") \
+    X(CFG_CLAUSE_CERT_FILE, "cert-file") \
+    X(CFG_CLAUSE_CHANNEL, "channel") \
+    X(CFG_CLAUSE_CHECKDS, "checkds") \
+    X(CFG_CLAUSE_CHECK_DUP_RECORDS, "check-dup-records") \
+    X(CFG_CLAUSE_CHECK_INTEGRITY, "check-integrity") \
+    X(CFG_CLAUSE_CHECKMODE, "checkmode") \
+    X(CFG_CLAUSE_CHECK_MX, "check-mx") \
+    X(CFG_CLAUSE_CHECK_MX_CNAME, "check-mx-cname") \
+    X(CFG_CLAUSE_CHECK_NAMES, "check-names") \
+    X(CFG_CLAUSE_CHECKNAMES, "checknames") \
+    X(CFG_CLAUSE_CHECK_SIBLING, "check-sibling") \
+    X(CFG_CLAUSE_CHECK_SPF, "check-spf") \
+    X(CFG_CLAUSE_CHECK_SRV_CNAME, "check-srv-cname") \
+    X(CFG_CLAUSE_CHECK_SVCB, "check-svcb") \
+    X(CFG_CLAUSE_CHECKTYPE, "checktype") \
+    X(CFG_CLAUSE_CHECK_WILDCARD, "check-wildcard") \
+    X(CFG_CLAUSE_CIPHERS, "ciphers") \
+    X(CFG_CLAUSE_CIPHER_SUITES, "cipher-suites") \
+    X(CFG_CLAUSE_CLASS, "class") \
+    X(CFG_CLAUSE_CLEANING_INTERVAL, "cleaning-interval") \
+    X(CFG_CLAUSE_CLIENTS, "clients") \
+    X(CFG_CLAUSE_CLIENTS_PER_QUERY, "clients-per-query") \
+    X(CFG_CLAUSE_CNAME, "cname") \
+    X(CFG_CLAUSE_CONTROLS, "controls") \
+    X(CFG_CLAUSE_COOKIEALG, "cookiealg") \
+    X(CFG_CLAUSE_COOKIE_ALGORITHM, "cookie-algorithm") \
+    X(CFG_CLAUSE_COOKIE_SECRET, "cookie-secret") \
+    X(CFG_CLAUSE_CORESIZE, "coresize") \
+    X(CFG_CLAUSE_CRITICAL, "critical") \
+    X(CFG_CLAUSE_CSK, "csk") \
+    X(CFG_CLAUSE_DATA, "data") \
+    X(CFG_CLAUSE_DATABASE, "database") \
+    X(CFG_CLAUSE_DATASIZE, "datasize") \
+    X(CFG_CLAUSE_DATE, "date") \
+    X(CFG_CLAUSE_DEALLOCATE_ON_EXIT, "deallocate-on-exit") \
+    X(CFG_CLAUSE_DEBUG, "debug") \
+    X(CFG_CLAUSE_DEBUGLEVEL, "debuglevel") \
+    X(CFG_CLAUSE_DEFAULT, "default") \
+    X(CFG_CLAUSE_DEFAULT_KEY, "default-key") \
+    X(CFG_CLAUSE_DEFAULT_MASTERS, "default-masters") \
+    X(CFG_CLAUSE_DEFAULT_PORT, "default-port") \
+    X(CFG_CLAUSE_DEFAULT_PRIMARIES, "default-primaries") \
+    X(CFG_CLAUSE_DEFAULT_SERVER, "default-server") \
+    X(CFG_CLAUSE_DEFAULT_SOURCE_ADDRESS, "default-source-address") \
+    X(CFG_CLAUSE_DEFAULT_SOURCE_ADDRESS_V6, "default-source-address-v6") \
+    X(CFG_CLAUSE_DELEGATION_ONLY, "delegation-only") \
+    X(CFG_CLAUSE_DELV, "delv") \
+    X(CFG_CLAUSE_DENY, "deny") \
+    X(CFG_CLAUSE_DENY_ANSWER_ADDRESSES, "deny-answer-addresses") \
+    X(CFG_CLAUSE_DENY_ANSWER_ALIASES, "deny-answer-aliases") \
+    X(CFG_CLAUSE_DESTINATIONLIST, "destinationlist") \
+    X(CFG_CLAUSE_DESTINATIONS, "destinations") \
+    X(CFG_CLAUSE_DHPARAM_FILE, "dhparam-file") \
+    X(CFG_CLAUSE_DIALUP, "dialup") \
+    X(CFG_CLAUSE_DIGESTS, "digests") \
+    X(CFG_CLAUSE_DIRECTORY, "directory") \
+    X(CFG_CLAUSE_DISABLE_ALGORITHMS, "disable-algorithms") \
+    X(CFG_CLAUSE_DISABLED, "disabled") \
+    X(CFG_CLAUSE_DISABLE_DS_DIGESTS, "disable-ds-digests") \
+    X(CFG_CLAUSE_DISABLE_EMPTY_ZONE, "disable-empty-zone") \
+    X(CFG_CLAUSE_DISCOUNT, "discount") \
+    X(CFG_CLAUSE_DLZ, "dlz") \
+    X(CFG_CLAUSE_DNS64, "dns64") \
+    X(CFG_CLAUSE_DNS64_CONTACT, "dns64-contact") \
+    X(CFG_CLAUSE_DNS64_SERVER, "dns64-server") \
+    X(CFG_CLAUSE_DNSKEY_SIG_VALIDITY, "dnskey-sig-validity") \
+    X(CFG_CLAUSE_DNSKEY_TTL, "dnskey-ttl") \
+    X(CFG_CLAUSE_DNSRPS_ENABLE, "dnsrps-enable") \
+    X(CFG_CLAUSE_DNSRPS_LIBRARY, "dnsrps-library") \
+    X(CFG_CLAUSE_DNSRPS_OPTIONS, "dnsrps-options") \
+    X(CFG_CLAUSE_DNSSEC_ACCEPT_EXPIRED, "dnssec-accept-expired") \
+    X(CFG_CLAUSE_DNSSEC_DNSKEY_KSKONLY, "dnssec-dnskey-kskonly") \
+    X(CFG_CLAUSE_DNSSEC_ENABLE, "dnssec-enable") \
+    X(CFG_CLAUSE_DNSSECKEYS, "dnsseckeys") \
+    X(CFG_CLAUSE_DNSSEC_LOADKEYS_INTERVAL, "dnssec-loadkeys-interval") \
+    X(CFG_CLAUSE_DNSSEC_LOOKASIDE, "dnssec-lookaside") \
+    X(CFG_CLAUSE_DNSSEC_MUST_BE_SECURE, "dnssec-must-be-secure") \
+    X(CFG_CLAUSE_DNSSEC_POLICY, "dnssec-policy") \
+    X(CFG_CLAUSE_DNSSEC_SECURE_TO_INSECURE, "dnssec-secure-to-insecure") \
+    X(CFG_CLAUSE_DNSSEC_UPDATE_MODE, "dnssec-update-mode") \
+    X(CFG_CLAUSE_DNSSEC_VALIDATION, "dnssec-validation") \
+    X(CFG_CLAUSE_DNSTAP, "dnstap") \
+    X(CFG_CLAUSE_DNSTAP_IDENTITY, "dnstap-identity") \
+    X(CFG_CLAUSE_DNSTAP_OUTPUT, "dnstap-output") \
+    X(CFG_CLAUSE_DNSTAPOUTPUT, "dnstapoutput") \
+    X(CFG_CLAUSE_DNSTAP_TYPE, "dnstap_type") \
+    X(CFG_CLAUSE_DNSTAP_VALUE, "dnstap_value") \
+    X(CFG_CLAUSE_DNSTAP_VERSION, "dnstap-version") \
+    X(CFG_CLAUSE_DOH, "doh") \
+    X(CFG_CLAUSE_DROP, "drop") \
+    X(CFG_CLAUSE_DSCP, "dscp") \
+    X(CFG_CLAUSE_DSDIGESTLIST, "dsdigestlist") \
+    X(CFG_CLAUSE_DTMODE, "dtmode") \
+    X(CFG_CLAUSE_DUAL_STACK_SERVERS, "dual-stack-servers") \
+    X(CFG_CLAUSE_DUMP_FILE, "dump-file") \
+    X(CFG_CLAUSE_DYNDB, "dyndb") \
+    X(CFG_CLAUSE_EDE, "ede") \
+    X(CFG_CLAUSE_EDNS, "edns") \
+    X(CFG_CLAUSE_EDNS_UDP_SIZE, "edns-udp-size") \
+    X(CFG_CLAUSE_EDNS_VERSION, "edns-version") \
+    X(CFG_CLAUSE_ELIGIBLE, "eligible") \
+    X(CFG_CLAUSE_EMPTY_CONTACT, "empty-contact") \
+    X(CFG_CLAUSE_EMPTY_SERVER, "empty-server") \
+    X(CFG_CLAUSE_EMPTY_ZONES_ENABLE, "empty-zones-enable") \
+    X(CFG_CLAUSE_ENDPOINTS, "endpoints") \
+    X(CFG_CLAUSE_ERRORS_PER_SECOND, "errors-per-second") \
+    X(CFG_CLAUSE_EXCEPT_FROM, "except-from") \
+    X(CFG_CLAUSE_EXCLUDE, "exclude") \
+    X(CFG_CLAUSE_EXEMPT_CLIENTS, "exempt-clients") \
+    X(CFG_CLAUSE_EXPLICIT, "explicit") \
+    X(CFG_CLAUSE_FAIL, "fail") \
+    X(CFG_CLAUSE_FAKE_IQUERY, "fake-iquery") \
+    X(CFG_CLAUSE_FETCHES, "fetches") \
+    X(CFG_CLAUSE_FETCHESPER, "fetchesper") \
+    X(CFG_CLAUSE_FETCHES_PER_SERVER, "fetches-per-server") \
+    X(CFG_CLAUSE_FETCHES_PER_ZONE, "fetches-per-zone") \
+    X(CFG_CLAUSE_FETCH_GLUE, "fetch-glue") \
+    X(CFG_CLAUSE_FETCHQUOTA, "fetchquota") \
+    X(CFG_CLAUSE_FETCH_QUOTA_PARAMS, "fetch-quota-params") \
+    X(CFG_CLAUSE_FILE, "file") \
+    X(CFG_CLAUSE_FILES, "files") \
+    X(CFG_CLAUSE_FILTER_AAAA, "filter-aaaa") \
+    X(CFG_CLAUSE_FILTER_AAAA_ON_V4, "filter-aaaa-on-v4") \
+    X(CFG_CLAUSE_FILTER_AAAA_ON_V6, "filter-aaaa-on-v6") \
+    X(CFG_CLAUSE_FIRST, "first") \
+    X(CFG_CLAUSE_FLUSH_ZONES_ON_SHUTDOWN, "flush-zones-on-shutdown") \
+    X(CFG_CLAUSE_FORWARD, "forward") \
+    X(CFG_CLAUSE_FORWARDERS, "forwarders") \
+    X(CFG_CLAUSE_FREQUENCY, "frequency") \
+    X(CFG_CLAUSE_FSTRM_SET_BUFFER_HINT, "fstrm-set-buffer-hint") \
+    X(CFG_CLAUSE_FSTRM_SET_FLUSH_TIMEOUT, "fstrm-set-flush-timeout") \
+    X(CFG_CLAUSE_FSTRM_SET_INPUT_QUEUE_SIZE, "fstrm-set-input-queue-size") \
+    X(CFG_CLAUSE_FSTRM_SET_OUTPUT_NOTIFY_THRESHOLD, "fstrm-set-output-notify-threshold") \
+    X(CFG_CLAUSE_FSTRM_SET_OUTPUT_QUEUE_MODEL, "fstrm-set-output-queue-model") \
+    X(CFG_CLAUSE_FSTRM_SET_OUTPUT_QUEUE_SIZE, "fstrm-set-output-queue-size") \
+    X(CFG_CLAUSE_FSTRM_SET_REOPEN_INTERVAL, "fstrm-set-reopen-interval") \
+    X(CFG_CLAUSE_FULL, "full") \
+    X(CFG_CLAUSE_GEOIP_DIRECTORY, "geoip-directory") \
+    X(CFG_CLAUSE_GEOIP_USE_ECS, "geoip-use-ecs") \
+    X(CFG_CLAUSE_GLUE_CACHE, "glue-cache") \
+    X(CFG_CLAUSE_GRANT, "grant") \
+    X(CFG_CLAUSE_GROUP, "group") \
+    X(CFG_CLAUSE_HAS_OLD_CLIENTS, "has-old-clients") \
+    X(CFG_CLAUSE_HEARTBEAT_INTERVAL, "heartbeat-interval") \
+    X(CFG_CLAUSE_HIGH, "high") \
+    X(CFG_CLAUSE_HOSTNAME, "hostname") \
+    X(CFG_CLAUSE_HOST_STATISTICS, "host-statistics") \
+    X(CFG_CLAUSE_HOST_STATISTICS_MAX, "host-statistics-max") \
+    X(CFG_CLAUSE_HTTP, "http") \
+    X(CFG_CLAUSE_HTTP_LISTENER_CLIENTS, "http-listener-clients") \
+    X(CFG_CLAUSE_HTTP_PORT, "http-port") \
+    X(CFG_CLAUSE_HTTPS_PORT, "https-port") \
+    X(CFG_CLAUSE_HTTP_STREAMS_PER_CONNECTION, "http-streams-per-connection") \
+    X(CFG_CLAUSE_IDENTITY, "identity") \
+    X(CFG_CLAUSE_INCREMENT, "increment") \
+    X(CFG_CLAUSE_INET, "inet") \
+    X(CFG_CLAUSE_INITIAL_FILE, "initial-file") \
+    X(CFG_CLAUSE_INLINE_SIGNING, "inline-signing") \
+    X(CFG_CLAUSE_IN_MEMORY, "in-memory") \
+    X(CFG_CLAUSE_INTERFACE_INTERVAL, "interface-interval") \
+    X(CFG_CLAUSE_IN_VIEW, "in-view") \
+    X(CFG_CLAUSE_IPV4ONLY_CONTACT, "ipv4only-contact") \
+    X(CFG_CLAUSE_IPV4ONLY_ENABLE, "ipv4only-enable") \
+    X(CFG_CLAUSE_IPV4ONLY_SERVER, "ipv4only-server") \
+    X(CFG_CLAUSE_IPV4_PREFIX_LENGTH, "ipv4-prefix-length") \
+    X(CFG_CLAUSE_IPV6_PREFIX_LENGTH, "ipv6-prefix-length") \
+    X(CFG_CLAUSE_ISO8601, "iso8601") \
+    X(CFG_CLAUSE_ITERATIONS, "iterations") \
+    X(CFG_CLAUSE_IXFR_BASE, "ixfr-base") \
+    X(CFG_CLAUSE_IXFR_FROM_DIFFERENCES, "ixfr-from-differences") \
+    X(CFG_CLAUSE_IXFR_RATIO, "ixfr_ratio") \
+    X(CFG_CLAUSE_IXFR_TMP_FILE, "ixfr-tmp-file") \
+    X(CFG_CLAUSE_JOURNAL, "journal") \
+    X(CFG_CLAUSE_KASPKEY, "kaspkey") \
+    X(CFG_CLAUSE_KASPKEYS, "kaspkeys") \
+    X(CFG_CLAUSE_KEEP_RESPONSE_ORDER, "keep-response-order") \
+    X(CFG_CLAUSE_KEY, "key") \
+    X(CFG_CLAUSE_KEY_DIRECTORY, "key-directory") \
+    X(CFG_CLAUSE_KEY_FILE, "key-file") \
+    X(CFG_CLAUSE_KEYLIST, "keylist") \
+    X(CFG_CLAUSE_KEYREF, "keyref") \
+    X(CFG_CLAUSE_KEYS, "keys") \
+    X(CFG_CLAUSE_KEYSTORAGE, "keystorage") \
+    X(CFG_CLAUSE_KEY_STORE, "key-store") \
+    X(CFG_CLAUSE_LAME_TTL, "lame-ttl") \
+    X(CFG_CLAUSE_LENGTH, "length") \
+    X(CFG_CLAUSE_LIBRARY, "library") \
+    X(CFG_CLAUSE_LIFETIME, "lifetime") \
+    X(CFG_CLAUSE_LISTENER_CLIENTS, "listener-clients") \
+    X(CFG_CLAUSE_LISTEN_ON, "listen-on") \
+    X(CFG_CLAUSE_LISTENON, "listenon") \
+    X(CFG_CLAUSE_LISTEN_ON_V6, "listen-on-v6") \
+    X(CFG_CLAUSE_LMDB_MAPSIZE, "lmdb-mapsize") \
+    X(CFG_CLAUSE_LOCK_FILE, "lock-file") \
+    X(CFG_CLAUSE_LOG, "log") \
+    X(CFG_CLAUSE_LOG_FILE, "log_file") \
+    X(CFG_CLAUSE_LOGGING, "logging") \
+    X(CFG_CLAUSE_LOGLEVEL, "loglevel") \
+    X(CFG_CLAUSE_LOG_ONLY, "log-only") \
+    X(CFG_CLAUSE_LOG_REPORT_CHANNEL, "log-report-channel") \
+    X(CFG_CLAUSE_LOG_SEVERITY, "log_severity") \
+    X(CFG_CLAUSE_LOGSUFFIX, "logsuffix") \
+    X(CFG_CLAUSE_LOW, "low") \
+    X(CFG_CLAUSE_LWRES, "lwres") \
+    X(CFG_CLAUSE_MAINTAIN, "maintain") \
+    X(CFG_CLAUSE_MAINTAIN_IXFR_BASE, "maintain-ixfr-base") \
+    X(CFG_CLAUSE_MANAGEDKEY, "managedkey") \
+    X(CFG_CLAUSE_MANAGED_KEYS, "managed-keys") \
+    X(CFG_CLAUSE_MANAGED_KEYS_DIRECTORY, "managed-keys-directory") \
+    X(CFG_CLAUSE_MANUAL_MODE, "manual-mode") \
+    X(CFG_CLAUSE_MANY_ANSWERS, "many-answers") \
+    X(CFG_CLAUSE_MAPPED, "mapped") \
+    X(CFG_CLAUSE_MASTERFILE_FORMAT, "masterfile-format") \
+    X(CFG_CLAUSE_MASTERFILE_STYLE, "masterfile-style") \
+    X(CFG_CLAUSE_MASTERS, "masters") \
+    X(CFG_CLAUSE_MATCH_CLIENTS, "match-clients") \
+    X(CFG_CLAUSE_MATCH_DESTINATIONS, "match-destinations") \
+    X(CFG_CLAUSE_MATCH_MAPPED_ADDRESSES, "match-mapped-addresses") \
+    X(CFG_CLAUSE_MATCH_RECURSIVE_ONLY, "match-recursive-only") \
+    X(CFG_CLAUSE_MATCHTYPE, "matchtype") \
+    X(CFG_CLAUSE_MAX_ACACHE_SIZE, "max-acache-size") \
+    X(CFG_CLAUSE_MAX_CACHE_SIZE, "max-cache-size") \
+    X(CFG_CLAUSE_MAX_CACHE_TTL, "max-cache-ttl") \
+    X(CFG_CLAUSE_MAX_CLIENTS_PER_QUERY, "max-clients-per-query") \
+    X(CFG_CLAUSE_MAX_DELEGATION_SERVERS, "max-delegation-servers") \
+    X(CFG_CLAUSE_MAX_IXFR_LOG_SIZE, "max-ixfr-log-size") \
+    X(CFG_CLAUSE_MAX_IXFR_RATIO, "max-ixfr-ratio") \
+    X(CFG_CLAUSE_MAX_JOURNAL_SIZE, "max-journal-size") \
+    X(CFG_CLAUSE_MAX_NCACHE_TTL, "max-ncache-ttl") \
+    X(CFG_CLAUSE_MAX_POLICY_TTL, "max-policy-ttl") \
+    X(CFG_CLAUSE_MAX_QUERY_COUNT, "max-query-count") \
+    X(CFG_CLAUSE_MAX_QUERY_RESTARTS, "max-query-restarts") \
+    X(CFG_CLAUSE_MAX_RECORDS, "max-records") \
+    X(CFG_CLAUSE_MAX_RECORDS_PER_TYPE, "max-records-per-type") \
+    X(CFG_CLAUSE_MAX_RECURSION_DEPTH, "max-recursion-depth") \
+    X(CFG_CLAUSE_MAX_RECURSION_QUERIES, "max-recursion-queries") \
+    X(CFG_CLAUSE_MAX_REFRESH_TIME, "max-refresh-time") \
+    X(CFG_CLAUSE_MAX_RETRY_TIME, "max-retry-time") \
+    X(CFG_CLAUSE_MAX_RSA_EXPONENT_SIZE, "max-rsa-exponent-size") \
+    X(CFG_CLAUSE_MAX_STALE_TTL, "max-stale-ttl") \
+    X(CFG_CLAUSE_MAX_TABLE_SIZE, "max-table-size") \
+    X(CFG_CLAUSE_MAX_TRANSFER_IDLE_IN, "max-transfer-idle-in") \
+    X(CFG_CLAUSE_MAX_TRANSFER_IDLE_OUT, "max-transfer-idle-out") \
+    X(CFG_CLAUSE_MAX_TRANSFER_TIME_IN, "max-transfer-time-in") \
+    X(CFG_CLAUSE_MAX_TRANSFER_TIME_OUT, "max-transfer-time-out") \
+    X(CFG_CLAUSE_MAX_TYPES_PER_NAME, "max-types-per-name") \
+    X(CFG_CLAUSE_MAX_UDP_SIZE, "max-udp-size") \
+    X(CFG_CLAUSE_MAX_VALIDATION_FAILURES_PER_FETCH, "max-validation-failures-per-fetch") \
+    X(CFG_CLAUSE_MAX_VALIDATIONS_PER_FETCH, "max-validations-per-fetch") \
+    X(CFG_CLAUSE_MAX_ZONE_TTL, "max-zone-ttl") \
+    X(CFG_CLAUSE_MEMSTATISTICS, "memstatistics") \
+    X(CFG_CLAUSE_MEMSTATISTICS_FILE, "memstatistics-file") \
+    X(CFG_CLAUSE_MESSAGE_COMPRESSION, "message-compression") \
+    X(CFG_CLAUSE_MIN_CACHE_TTL, "min-cache-ttl") \
+    X(CFG_CLAUSE_MINIMAL_ANY, "minimal-any") \
+    X(CFG_CLAUSE_MINIMAL_RESPONSES, "minimal-responses") \
+    X(CFG_CLAUSE_MIN_NCACHE_TTL, "min-ncache-ttl") \
+    X(CFG_CLAUSE_MIN_NS_DOTS, "min-ns-dots") \
+    X(CFG_CLAUSE_MIN_REFRESH_TIME, "min-refresh-time") \
+    X(CFG_CLAUSE_MIN_RETRY_TIME, "min-retry-time") \
+    X(CFG_CLAUSE_MIN_ROOTS, "min-roots") \
+    X(CFG_CLAUSE_MIN_TABLE_SIZE, "min-table-size") \
+    X(CFG_CLAUSE_MIN_TRANSFER_RATE_IN, "min-transfer-rate-in") \
+    X(CFG_CLAUSE_MIN_UPDATE_INTERVAL, "min-update-interval") \
+    X(CFG_CLAUSE_MODE, "mode") \
+    X(CFG_CLAUSE_MPSC, "mpsc") \
+    X(CFG_CLAUSE_MULTI_MASTER, "multi-master") \
+    X(CFG_CLAUSE_MULTIPLE_CNAMES, "multiple-cnames") \
+    X(CFG_CLAUSE_NAME, "name") \
+    X(CFG_CLAUSE_NAMEDCONF, "namedconf") \
+    X(CFG_CLAUSE_NAMED_XFER, "named-xfer") \
+    X(CFG_CLAUSE_NAMELIST, "namelist") \
+    X(CFG_CLAUSE_NAMEPORT, "nameport") \
+    X(CFG_CLAUSE_NEW_ZONES_DIRECTORY, "new-zones-directory") \
+    X(CFG_CLAUSE_NO_AUTH, "no-auth") \
+    X(CFG_CLAUSE_NO_CASE_COMPRESS, "no-case-compress") \
+    X(CFG_CLAUSE_NOCOOKIE_UDP_SIZE, "nocookie-udp-size") \
+    X(CFG_CLAUSE_NODATA_PER_SECOND, "nodata-per-second") \
+    X(CFG_CLAUSE_NONE, "none") \
+    X(CFG_CLAUSE_NOSIT_UDP_SIZE, "nosit-udp-size") \
+    X(CFG_CLAUSE_NOTIFY, "notify") \
+    X(CFG_CLAUSE_NOTIFY_CFG, "notify-cfg") \
+    X(CFG_CLAUSE_NOTIFY_DEFER, "notify-defer") \
+    X(CFG_CLAUSE_NOTIFY_DELAY, "notify-delay") \
+    X(CFG_CLAUSE_NOTIFY_RATE, "notify-rate") \
+    X(CFG_CLAUSE_NOTIFY_SOURCE, "notify-source") \
+    X(CFG_CLAUSE_NOTIFY_SOURCE_V6, "notify-source-v6") \
+    X(CFG_CLAUSE_NOTIFY_TO_SOA, "notify-to-soa") \
+    X(CFG_CLAUSE_NSDNAME_ENABLE, "nsdname-enable") \
+    X(CFG_CLAUSE_NSDNAME_WAIT_RECURSE, "nsdname-wait-recurse") \
+    X(CFG_CLAUSE_NSEC3PARAM, "nsec3param") \
+    X(CFG_CLAUSE_NSEC3_TEST_ZONE, "nsec3-test-zone") \
+    X(CFG_CLAUSE_NSIP_ENABLE, "nsip-enable") \
+    X(CFG_CLAUSE_NSIP_WAIT_RECURSE, "nsip-wait-recurse") \
+    X(CFG_CLAUSE_NTA_LIFETIME, "nta-lifetime") \
+    X(CFG_CLAUSE_NTA_RECHECK, "nta-recheck") \
+    X(CFG_CLAUSE_NULL, "null") \
+    X(CFG_CLAUSE_NXDOMAIN_REDIRECT, "nxdomain-redirect") \
+    X(CFG_CLAUSE_NXDOMAINS_PER_SECOND, "nxdomains-per-second") \
+    X(CFG_CLAUSE_OFFLINE_KSK, "offline-ksk") \
+    X(CFG_CLAUSE_OPTIONAL_CLASS, "optional_class") \
+    X(CFG_CLAUSE_OPTIONAL_FACILITY, "optional_facility") \
+    X(CFG_CLAUSE_OPTIONAL_UINT32, "optional_uint32") \
+    X(CFG_CLAUSE_OPTIONS, "options") \
+    X(CFG_CLAUSE_OPTOUT, "optout") \
+    X(CFG_CLAUSE_ORDER, "order") \
+    X(CFG_CLAUSE_ORDERING, "ordering") \
+    X(CFG_CLAUSE_OWNER, "owner") \
+    X(CFG_CLAUSE_PADDING, "padding") \
+    X(CFG_CLAUSE_PARAMETERS, "parameters") \
+    X(CFG_CLAUSE_PARENTAL_AGENTS, "parental-agents") \
+    X(CFG_CLAUSE_PARENTAL_SOURCE, "parental-source") \
+    X(CFG_CLAUSE_PARENTAL_SOURCE_V6, "parental-source-v6") \
+    X(CFG_CLAUSE_PARENT_DS_TTL, "parent-ds-ttl") \
+    X(CFG_CLAUSE_PARENT_PROPAGATION_DELAY, "parent-propagation-delay") \
+    X(CFG_CLAUSE_PARENT_REGISTRATION_DELAY, "parent-registration-delay") \
+    X(CFG_CLAUSE_PATH, "path") \
+    X(CFG_CLAUSE_PERM, "perm") \
+    X(CFG_CLAUSE_PID_FILE, "pid-file") \
+    X(CFG_CLAUSE_PKCS11_URI, "pkcs11-uri") \
+    X(CFG_CLAUSE_PLUGIN, "plugin") \
+    X(CFG_CLAUSE_PLUGINTYPE, "plugintype") \
+    X(CFG_CLAUSE_POLICY, "policy") \
+    X(CFG_CLAUSE_POLICY_NAME, "policy name") \
+    X(CFG_CLAUSE_POLICY_TUPLE, "policy tuple") \
+    X(CFG_CLAUSE_PORT, "port") \
+    X(CFG_CLAUSE_PORTIPLIST, "portiplist") \
+    X(CFG_CLAUSE_PORT_TRANSPORT, "port-transport") \
+    X(CFG_CLAUSE_PREFERRED_GLUE, "preferred-glue") \
+    X(CFG_CLAUSE_PREFER_SERVER_CIPHERS, "prefer-server-ciphers") \
+    X(CFG_CLAUSE_PREFETCH, "prefetch") \
+    X(CFG_CLAUSE_PRIMARIES, "primaries") \
+    X(CFG_CLAUSE_PRIMARY, "primary") \
+    X(CFG_CLAUSE_PRINT_CATEGORY, "print-category") \
+    X(CFG_CLAUSE_PRINT_SEVERITY, "print-severity") \
+    X(CFG_CLAUSE_PRINT_TIME, "print-time") \
+    X(CFG_CLAUSE_PRINTTIME, "printtime") \
+    X(CFG_CLAUSE_PROTOCOLS, "protocols") \
+    X(CFG_CLAUSE_PROVIDE_IXFR, "provide-ixfr") \
+    X(CFG_CLAUSE_PROVIDE_ZONEVERSION, "provide-zoneversion") \
+    X(CFG_CLAUSE_PROXY, "proxy") \
+    X(CFG_CLAUSE_PUBKEY, "pubkey") \
+    X(CFG_CLAUSE_PUBLISH_SAFETY, "publish-safety") \
+    X(CFG_CLAUSE_PURGE_KEYS, "purge-keys") \
+    X(CFG_CLAUSE_QMINMETHOD, "qminmethod") \
+    X(CFG_CLAUSE_QNAME_MINIMIZATION, "qname-minimization") \
+    X(CFG_CLAUSE_QNAME_WAIT_RECURSE, "qname-wait-recurse") \
+    X(CFG_CLAUSE_QPS_SCALE, "qps-scale") \
+    X(CFG_CLAUSE_QSTRINGORNONE, "qstringornone") \
+    X(CFG_CLAUSE_QUERY, "query") \
+    X(CFG_CLAUSE_QUERYLOG, "querylog") \
+    X(CFG_CLAUSE_QUERYPORT_POOL_PORTS, "queryport-pool-ports") \
+    X(CFG_CLAUSE_QUERYPORT_POOL_UPDATEINTERVAL, "queryport-pool-updateinterval") \
+    X(CFG_CLAUSE_QUERY_SOURCE, "query-source") \
+    X(CFG_CLAUSE_QUERYSOURCE, "querysource") \
+    X(CFG_CLAUSE_QUERY_SOURCE_V6, "query-source-v6") \
+    X(CFG_CLAUSE_RANDOM_DEVICE, "random-device") \
+    X(CFG_CLAUSE_RATE_LIMIT, "rate-limit") \
+    X(CFG_CLAUSE_RAW, "raw") \
+    X(CFG_CLAUSE_RDATA1, "rdata1") \
+    X(CFG_CLAUSE_RDATA2, "rdata2") \
+    X(CFG_CLAUSE_RDATA3, "rdata3") \
+    X(CFG_CLAUSE_READ_ONLY, "read-only") \
+    X(CFG_CLAUSE_RECURSING_FILE, "recursing-file") \
+    X(CFG_CLAUSE_RECURSION, "recursion") \
+    X(CFG_CLAUSE_RECURSIVE_CLIENTS, "recursive-clients") \
+    X(CFG_CLAUSE_RECURSIVE_ONLY, "recursive-only") \
+    X(CFG_CLAUSE_REFERRALS_PER_SECOND, "referrals-per-second") \
+    X(CFG_CLAUSE_REMOTE_HOSTNAME, "remote-hostname") \
+    X(CFG_CLAUSE_REMOTES_ELEMENT, "remotes_element") \
+    X(CFG_CLAUSE_REMOTESELEMENT, "remoteselement") \
+    X(CFG_CLAUSE_REMOTE_SERVERS, "remote-servers") \
+    X(CFG_CLAUSE_REQUEST_EXPIRE, "request-expire") \
+    X(CFG_CLAUSE_REQUEST_IXFR, "request-ixfr") \
+    X(CFG_CLAUSE_REQUEST_IXFR_MAX_DIFFS, "request-ixfr-max-diffs") \
+    X(CFG_CLAUSE_REQUEST_NSID, "request-nsid") \
+    X(CFG_CLAUSE_REQUEST_SIT, "request-sit") \
+    X(CFG_CLAUSE_REQUEST_ZONEVERSION, "request-zoneversion") \
+    X(CFG_CLAUSE_REQUIRE_COOKIE, "require-cookie") \
+    X(CFG_CLAUSE_REQUIRE_SERVER_COOKIE, "require-server-cookie") \
+    X(CFG_CLAUSE_RESERVED_SOCKETS, "reserved-sockets") \
+    X(CFG_CLAUSE_RE_SIGN, "re-sign") \
+    X(CFG_CLAUSE_RESOLVER_NONBACKOFF_TRIES, "resolver-nonbackoff-tries") \
+    X(CFG_CLAUSE_RESOLVER_QUERY_TIMEOUT, "resolver-query-timeout") \
+    X(CFG_CLAUSE_RESOLVER_RETRY_INTERVAL, "resolver-retry-interval") \
+    X(CFG_CLAUSE_RESOLVER_USE_DNS64, "resolver-use-dns64") \
+    X(CFG_CLAUSE_RESPONSE, "response") \
+    X(CFG_CLAUSE_RESPONSELOG, "responselog") \
+    X(CFG_CLAUSE_RESPONSE_PADDING, "response-padding") \
+    X(CFG_CLAUSE_RESPONSE_POLICY, "response-policy") \
+    X(CFG_CLAUSE_RESPONSES_PER_SECOND, "responses-per-second") \
+    X(CFG_CLAUSE_RETIRE_SAFETY, "retire-safety") \
+    X(CFG_CLAUSE_REUSEPORT, "reuseport") \
+    X(CFG_CLAUSE_RFC2308_TYPE1, "rfc2308-type1") \
+    X(CFG_CLAUSE_RNDCCONF, "rndcconf") \
+    X(CFG_CLAUSE_RNDCKEY, "rndckey") \
+    X(CFG_CLAUSE_ROLE, "role") \
+    X(CFG_CLAUSE_ROOT_DELEGATION_ONLY, "root-delegation-only") \
+    X(CFG_CLAUSE_ROOT_KEY_SENTINEL, "root-key-sentinel") \
+    X(CFG_CLAUSE_RPZ, "rpz") \
+    X(CFG_CLAUSE_RPZ_TUPLE, "rpz tuple") \
+    X(CFG_CLAUSE_RRSET_ORDER, "rrset-order") \
+    X(CFG_CLAUSE_RRSETORDER, "rrsetorder") \
+    X(CFG_CLAUSE_SALT_LENGTH, "salt-length") \
+    X(CFG_CLAUSE_SEARCH, "search") \
+    X(CFG_CLAUSE_SECRET, "secret") \
+    X(CFG_CLAUSE_SECROOTS_FILE, "secroots-file") \
+    X(CFG_CLAUSE_SEND_COOKIE, "send-cookie") \
+    X(CFG_CLAUSE_SEND_REPORT_CHANNEL, "send-report-channel") \
+    X(CFG_CLAUSE_SERIAL_QUERIES, "serial-queries") \
+    X(CFG_CLAUSE_SERIAL_QUERY_RATE, "serial-query-rate") \
+    X(CFG_CLAUSE_SERIAL_UPDATE_METHOD, "serial-update-method") \
+    X(CFG_CLAUSE_SERVER, "server") \
+    X(CFG_CLAUSE_SERVER_ADDRESSES, "server-addresses") \
+    X(CFG_CLAUSE_SERVER_ID, "server-id") \
+    X(CFG_CLAUSE_SERVERID, "serverid") \
+    X(CFG_CLAUSE_SERVER_LIST, "server-list") \
+    X(CFG_CLAUSE_SERVER_NAMES, "server-names") \
+    X(CFG_CLAUSE_SERVFAIL_TTL, "servfail-ttl") \
+    X(CFG_CLAUSE_SERVFAIL_UNTIL_READY, "servfail-until-ready") \
+    X(CFG_CLAUSE_SESSIONKEY, "sessionkey") \
+    X(CFG_CLAUSE_SESSION_KEYALG, "session-keyalg") \
+    X(CFG_CLAUSE_SESSION_KEYFILE, "session-keyfile") \
+    X(CFG_CLAUSE_SESSION_KEYNAME, "session-keyname") \
+    X(CFG_CLAUSE_SESSION_TICKETS, "session-tickets") \
+    X(CFG_CLAUSE_SEVERITY, "severity") \
+    X(CFG_CLAUSE_SIG0CHECKS_QUOTA, "sig0checks-quota") \
+    X(CFG_CLAUSE_SIG0CHECKS_QUOTA_EXEMPT, "sig0checks-quota-exempt") \
+    X(CFG_CLAUSE_SIG0KEY_CHECKS_LIMIT, "sig0key-checks-limit") \
+    X(CFG_CLAUSE_SIG0MESSAGE_CHECKS_LIMIT, "sig0message-checks-limit") \
+    X(CFG_CLAUSE_SIGNATURES_JITTER, "signatures-jitter") \
+    X(CFG_CLAUSE_SIGNATURES_REFRESH, "signatures-refresh") \
+    X(CFG_CLAUSE_SIGNATURES_VALIDITY, "signatures-validity") \
+    X(CFG_CLAUSE_SIGNATURES_VALIDITY_DNSKEY, "signatures-validity-dnskey") \
+    X(CFG_CLAUSE_SIG_SIGNING_NODES, "sig-signing-nodes") \
+    X(CFG_CLAUSE_SIG_SIGNING_SIGNATURES, "sig-signing-signatures") \
+    X(CFG_CLAUSE_SIG_SIGNING_TYPE, "sig-signing-type") \
+    X(CFG_CLAUSE_SIG_VALIDITY_INTERVAL, "sig-validity-interval") \
+    X(CFG_CLAUSE_SIPHASH24, "siphash24") \
+    X(CFG_CLAUSE_SIT_SECRET, "sit-secret") \
+    X(CFG_CLAUSE_SIZE, "size") \
+    X(CFG_CLAUSE_SIZEVAL, "sizeval") \
+    X(CFG_CLAUSE_SLIP, "slip") \
+    X(CFG_CLAUSE_SOCKADDRNAMEPORT_ELEMENT, "sockaddrnameport_element") \
+    X(CFG_CLAUSE_SORTLIST, "sortlist") \
+    X(CFG_CLAUSE_SOURCE, "source") \
+    X(CFG_CLAUSE_SOURCE_ADDRESS, "source-address") \
+    X(CFG_CLAUSE_SOURCE_ADDRESS_V6, "source-address-v6") \
+    X(CFG_CLAUSE_SOURCE_V6, "source-v6") \
+    X(CFG_CLAUSE_STACKSIZE, "stacksize") \
+    X(CFG_CLAUSE_STALE_ANSWER_CLIENT_TIMEOUT, "stale-answer-client-timeout") \
+    X(CFG_CLAUSE_STALE_ANSWER_ENABLE, "stale-answer-enable") \
+    X(CFG_CLAUSE_STALE_ANSWER_TTL, "stale-answer-ttl") \
+    X(CFG_CLAUSE_STALE_CACHE_ENABLE, "stale-cache-enable") \
+    X(CFG_CLAUSE_STALE_REFRESH_TIME, "stale-refresh-time") \
+    X(CFG_CLAUSE_STARTUP_NOTIFY_RATE, "startup-notify-rate") \
+    X(CFG_CLAUSE_STATIC_KEY, "static-key") \
+    X(CFG_CLAUSE_STATISTICS_CHANNELS, "statistics-channels") \
+    X(CFG_CLAUSE_STATISTICS_FILE, "statistics-file") \
+    X(CFG_CLAUSE_STATISTICS_INTERVAL, "statistics-interval") \
+    X(CFG_CLAUSE_STDERR, "stderr") \
+    X(CFG_CLAUSE_STREAMS_PER_CONNECTION, "streams-per-connection") \
+    X(CFG_CLAUSE_STRICT, "strict") \
+    X(CFG_CLAUSE_SUFFIX, "suffix") \
+    X(CFG_CLAUSE_SUPPORT_IXFR, "support-ixfr") \
+    X(CFG_CLAUSE_SUPPRESS_INITIAL_NOTIFY, "suppress-initial-notify") \
+    X(CFG_CLAUSE_SYNTH_FROM_DNSSEC, "synth-from-dnssec") \
+    X(CFG_CLAUSE_SYSLOG, "syslog") \
+    X(CFG_CLAUSE_TAG_MAX, "tag-max") \
+    X(CFG_CLAUSE_TAG_MIN, "tag-min") \
+    X(CFG_CLAUSE_TAG_RANGE, "tag-range") \
+    X(CFG_CLAUSE_TAGRANGE, "tagrange") \
+    X(CFG_CLAUSE_TCP_ADVERTISED_TIMEOUT, "tcp-advertised-timeout") \
+    X(CFG_CLAUSE_TCP_CLIENTS, "tcp-clients") \
+    X(CFG_CLAUSE_TCP_IDLE_TIMEOUT, "tcp-idle-timeout") \
+    X(CFG_CLAUSE_TCP_INITIAL_TIMEOUT, "tcp-initial-timeout") \
+    X(CFG_CLAUSE_TCP_KEEPALIVE, "tcp-keepalive") \
+    X(CFG_CLAUSE_TCP_KEEPALIVE_TIMEOUT, "tcp-keepalive-timeout") \
+    X(CFG_CLAUSE_TCP_LISTEN_QUEUE, "tcp-listen-queue") \
+    X(CFG_CLAUSE_TCP_ONLY, "tcp-only") \
+    X(CFG_CLAUSE_TCP_PRIMARIES_TIMEOUT, "tcp-primaries-timeout") \
+    X(CFG_CLAUSE_TCP_RECEIVE_BUFFER, "tcp-receive-buffer") \
+    X(CFG_CLAUSE_TCP_SEND_BUFFER, "tcp-send-buffer") \
+    X(CFG_CLAUSE_TEMPLATE, "template") \
+    X(CFG_CLAUSE_TIME_MINUTES, "time_minutes") \
+    X(CFG_CLAUSE_TKEY_DHKEY, "tkey-dhkey") \
+    X(CFG_CLAUSE_TKEY_DOMAIN, "tkey-domain") \
+    X(CFG_CLAUSE_TKEY_GSSAPI_CREDENTIAL, "tkey-gssapi-credential") \
+    X(CFG_CLAUSE_TKEY_GSSAPI_KEYTAB, "tkey-gssapi-keytab") \
+    X(CFG_CLAUSE_TLS, "tls") \
+    X(CFG_CLAUSE_TLSCONF, "tlsconf") \
+    X(CFG_CLAUSE_TLS_PORT, "tls-port") \
+    X(CFG_CLAUSE_TLS_PROTOCOLS, "tls_protocols") \
+    X(CFG_CLAUSE_TOPOLOGY, "topology") \
+    X(CFG_CLAUSE_TRAFFIC_BYTES, "traffic_bytes") \
+    X(CFG_CLAUSE_TRANSFER_FORMAT, "transfer-format") \
+    X(CFG_CLAUSE_TRANSFER_MESSAGE_SIZE, "transfer-message-size") \
+    X(CFG_CLAUSE_TRANSFERS, "transfers") \
+    X(CFG_CLAUSE_TRANSFERS_IN, "transfers-in") \
+    X(CFG_CLAUSE_TRANSFER_SOURCE, "transfer-source") \
+    X(CFG_CLAUSE_TRANSFER_SOURCE_V6, "transfer-source-v6") \
+    X(CFG_CLAUSE_TRANSFERS_OUT, "transfers-out") \
+    X(CFG_CLAUSE_TRANSFERS_PER_NS, "transfers-per-ns") \
+    X(CFG_CLAUSE_TRANSPORT, "transport") \
+    X(CFG_CLAUSE_TREAT_CR_AS_SPACE, "treat-cr-as-space") \
+    X(CFG_CLAUSE_TRIGGER, "trigger") \
+    X(CFG_CLAUSE_TRUST_ANCHORS, "trust-anchors") \
+    X(CFG_CLAUSE_TRUST_ANCHOR_TELEMETRY, "trust-anchor-telemetry") \
+    X(CFG_CLAUSE_TRUSTED_KEYS, "trusted-keys") \
+    X(CFG_CLAUSE_TRY_TCP_REFRESH, "try-tcp-refresh") \
+    X(CFG_CLAUSE_TUPLE, "tuple") \
+    X(CFG_CLAUSE_TYPE, "type") \
+    X(CFG_CLAUSE_TYPES, "types") \
+    X(CFG_CLAUSE_UDP_RECEIVE_BUFFER, "udp-receive-buffer") \
+    X(CFG_CLAUSE_UDP_SEND_BUFFER, "udp-send-buffer") \
+    X(CFG_CLAUSE_UNIX, "unix") \
+    X(CFG_CLAUSE_UNLIMITED, "unlimited") \
+    X(CFG_CLAUSE_UPDATE_CHECK_KSK, "update-check-ksk") \
+    X(CFG_CLAUSE_UPDATE_POLICY, "update-policy") \
+    X(CFG_CLAUSE_UPDATE_QUOTA, "update-quota") \
+    X(CFG_CLAUSE_USE_ALT_TRANSFER_SOURCE, "use-alt-transfer-source") \
+    X(CFG_CLAUSE_USE_ID_POOL, "use-id-pool") \
+    X(CFG_CLAUSE_USE_IXFR, "use-ixfr") \
+    X(CFG_CLAUSE_USE_QUERYPORT_POOL, "use-queryport-pool") \
+    X(CFG_CLAUSE_USE_V4_UDP_PORTS, "use-v4-udp-ports") \
+    X(CFG_CLAUSE_USE_V6_UDP_PORTS, "use-v6-udp-ports") \
+    X(CFG_CLAUSE_V6_BIAS, "v6-bias") \
+    X(CFG_CLAUSE_VALIDATE_EXCEPT, "validate-except") \
+    X(CFG_CLAUSE_VALIDITY, "validity") \
+    X(CFG_CLAUSE_VALUE, "value") \
+    X(CFG_CLAUSE_VERSION, "version") \
+    X(CFG_CLAUSE_VERSIONS, "versions") \
+    X(CFG_CLAUSE_VIEW, "view") \
+    X(CFG_CLAUSE_WARN, "warn") \
+    X(CFG_CLAUSE_WINDOW, "window") \
+    X(CFG_CLAUSE_ZERO_NO_SOA_TTL, "zero-no-soa-ttl") \
+    X(CFG_CLAUSE_ZERO_NO_SOA_TTL_CACHE, "zero-no-soa-ttl-cache") \
+    X(CFG_CLAUSE_ZONE, "zone") \
+    X(CFG_CLAUSE_ZONE_DIRECTORY, "zone-directory") \
+    X(CFG_CLAUSE_ZONE_LIST, "zone list") \
+    X(CFG_CLAUSE_ZONE_NAME, "zone name") \
+    X(CFG_CLAUSE_ZONEOPTS, "zoneopts") \
+    X(CFG_CLAUSE_ZONE_PROPAGATION_DELAY, "zone-propagation-delay") \
+    X(CFG_CLAUSE_ZONESTAT, "zonestat") \
+    X(CFG_CLAUSE_ZONE_STATISTICS, "zone-statistics") \
+    X(CFG_CLAUSE_ZONETYPE, "zonetype") \
+
+/* clang-format on */
+
+enum cfg_clause {
+	CFG_CLAUSE__NONE = 0,
+#define X(name, str) name,
+	CFG_CLAUSES
+#undef X
+	CFG_CLAUSE__COUNT
+};
+
+extern const char *cfg_clause_as_string[];
diff --git a/lib/isccfg/include/isccfg/grammar.h b/lib/isccfg/include/isccfg/grammar.h
index 2ba4358e313..a1754d9e7fe 100644
--- a/lib/isccfg/include/isccfg/grammar.h
+++ b/lib/isccfg/include/isccfg/grammar.h
@@ -25,6 +25,7 @@
 #include <isc/types.h>
 
 #include <isccfg/cfg.h>
+#include <isccfg/clause.h>
 #include <isccfg/duration.h>
 
 /*
@@ -87,11 +88,10 @@ enum {
 	CFG_ZONE_MIRROR = 1 << 23,
 };
 
-typedef struct cfg_clausedef	 cfg_clausedef_t;
 typedef struct cfg_tuplefielddef cfg_tuplefielddef_t;
-typedef struct cfg_printer	 cfg_printer_t;
+typedef struct cfg_printer	      cfg_printer_t;
 typedef ISC_LIST(cfg_listelt_t) cfg_list_t;
-typedef struct cfg_map	        cfg_map_t;
+typedef struct cfg_map		cfg_map_t;
 typedef struct cfg_map_external cfg_map_external_t;
 typedef struct cfg_rep		cfg_rep_t;
 
@@ -139,6 +139,13 @@ typedef void (*cfg_mergefunc_t)(const cfg_obj_t *config,
 				const cfg_obj_t *defaultobj);
 
 struct cfg_clausedef {
+	enum cfg_clause name;
+	cfg_type_t     *type;
+	unsigned int	flags;
+	cfg_mergefunc_t merge;
+};
+
+struct cfg_clausedef_external {
 	const char     *name;
 	cfg_type_t     *type;
 	unsigned int	flags;
@@ -180,9 +187,10 @@ struct cfg_map {
 struct cfg_map_external {
 	cfg_obj_t *id; /*%< Used for 'named maps' like
 			* keys, zones, &c */
-	const cfg_clausedef_t *const *clausesets; /*%< The clauses that
-						   * can occur in this map;
-						   * used for printing */
+	const cfg_clausedef_external_t *const *clausesets; /*%< The clauses that
+							    * can occur in this
+							    * map; used for
+							    * printing */
 	isc_symtab_t *symtab;
 };
 
@@ -653,7 +661,7 @@ cfg_is_enum(const char *s, const char *const *enums);
 /*%< Return true iff the string 's' is one of the strings in 'enums' */
 
 bool
-cfg_clause_validforzone(const char *name, unsigned int ztype);
+cfg_clause_validforzone(enum cfg_clause name, unsigned int ztype);
 /*%<
  * Check whether an option is legal for the specified zone type.
  */
diff --git a/lib/isccfg/meson.build b/lib/isccfg/meson.build
index 1d799e31944..a230aea6ad7 100644
--- a/lib/isccfg/meson.build
+++ b/lib/isccfg/meson.build
@@ -13,6 +13,7 @@ isccfg_srcset.add(
     files(
         'aclconf.c',
         'check.c',
+        'clause.c',
         'duration.c',
         'kaspconf.c',
         'namedconf.c',
diff --git a/lib/isccfg/namedconf.c b/lib/isccfg/namedconf.c
index fbccca2643d..d52480db926 100644
--- a/lib/isccfg/namedconf.c
+++ b/lib/isccfg/namedconf.c
@@ -27,6 +27,7 @@
 
 #include <dns/ttl.h>
 
+#include <isccfg/clause.h>
 #include <isccfg/cfg.h>
 #include <isccfg/grammar.h>
 #include <isccfg/namedconf.h>
@@ -1200,7 +1201,7 @@ policy_merge(const cfg_obj_t *config ISC_ATTR_UNUSED, cfg_obj_t *eff,
 }
 
 static void
-cloneto(cfg_obj_t *options, const cfg_obj_t *obj, const char *clausename) {
+cloneto(cfg_obj_t *options, const cfg_obj_t *obj, enum cfg_clause clausename) {
 	isc_result_t result;
 	const cfg_clausedef_t *clause = cfg_map_findclause(options->type,
 							   clausename);
@@ -1211,7 +1212,7 @@ cloneto(cfg_obj_t *options, const cfg_obj_t *obj, const char *clausename) {
 
 static void
 setdefaultacl(cfg_obj_t *options, const cfg_obj_t *defaultoptions,
-	      const char *aclname) {
+	      enum cfg_clause aclname) {
 	const cfg_obj_t *obj = NULL;
 	isc_result_t result;
 
@@ -1228,7 +1229,7 @@ setdefaultacl(cfg_obj_t *options, const cfg_obj_t *defaultoptions,
 }
 
 static const cfg_obj_t *
-aclobj(const cfg_obj_t *o, const cfg_obj_t *v, const char *name) {
+aclobj(const cfg_obj_t *o, const cfg_obj_t *v, enum cfg_clause name) {
 	const cfg_obj_t *obj = NULL;
 
 	cfg_map_get(v, name, &obj);
@@ -1245,7 +1246,7 @@ setacls(const cfg_obj_t *config, cfg_obj_t *voptions,
 	const cfg_obj_t *query = NULL, *cache = NULL, *cacheon = NULL;
 	const cfg_obj_t *recursion = NULL, *recursionon = NULL;
 
-	cfg_map_get(config, "options", &options);
+	cfg_map_get(config, CFG_CLAUSE_OPTIONS, &options);
 	INSIST(options != NULL);
 
 	/*
@@ -1255,12 +1256,12 @@ setacls(const cfg_obj_t *config, cfg_obj_t *voptions,
 	INSIST((options == voptions && defaultoptions != NULL) ||
 	       (options != voptions && defaultoptions == NULL));
 
-	query = aclobj(options, voptions, "allow-query");
-	recursion = aclobj(options, voptions, "allow-recursion");
-	cache = aclobj(options, voptions, "allow-query-cache");
+	query = aclobj(options, voptions, CFG_CLAUSE_ALLOW_QUERY);
+	recursion = aclobj(options, voptions, CFG_CLAUSE_ALLOW_RECURSION);
+	cache = aclobj(options, voptions, CFG_CLAUSE_ALLOW_QUERY_CACHE);
 
-	cacheon = aclobj(options, voptions, "allow-query-cache-on");
-	recursionon = aclobj(options, voptions, "allow-recursion-on");
+	cacheon = aclobj(options, voptions, CFG_CLAUSE_ALLOW_QUERY_CACHE_ON);
+	recursionon = aclobj(options, voptions, CFG_CLAUSE_ALLOW_RECURSION_ON);
 
 	bool aq = query != NULL && !query->cloned;
 	bool aqc = cache != NULL && !cache->cloned;
@@ -1275,9 +1276,9 @@ setacls(const cfg_obj_t *config, cfg_obj_t *voptions,
 	 */
 	if (!aqc) {
 		if (ar) {
-			cloneto(voptions, recursion, "allow-query-cache");
+			cloneto(voptions, recursion, CFG_CLAUSE_ALLOW_QUERY_CACHE);
 		} else if (aq) {
-			cloneto(voptions, query, "allow-query-cache");
+			cloneto(voptions, query, CFG_CLAUSE_ALLOW_QUERY_CACHE);
 		}
 	}
 
@@ -1287,9 +1288,9 @@ setacls(const cfg_obj_t *config, cfg_obj_t *voptions,
 	 */
 	if (!ar) {
 		if (aqc) {
-			cloneto(voptions, cache, "allow-recursion");
+			cloneto(voptions, cache, CFG_CLAUSE_ALLOW_RECURSION);
 		} else if (aq) {
-			cloneto(voptions, query, "allow-recursion");
+			cloneto(voptions, query, CFG_CLAUSE_ALLOW_RECURSION);
 		}
 	}
 
@@ -1298,9 +1299,9 @@ setacls(const cfg_obj_t *config, cfg_obj_t *voptions,
 	 * if set, and vice versa.
 	 */
 	if (!aqco && aro) {
-		cloneto(voptions, recursionon, "allow-query-cache-on");
+		cloneto(voptions, recursionon, CFG_CLAUSE_ALLOW_QUERY_CACHE_ON);
 	} else if (!aro && aqco) {
-		cloneto(voptions, cacheon, "allow-recursion-on");
+		cloneto(voptions, cacheon, CFG_CLAUSE_ALLOW_RECURSION_ON);
 	}
 
 	if (options == voptions) {
@@ -1309,10 +1310,10 @@ setacls(const cfg_obj_t *config, cfg_obj_t *voptions,
 		 * of the default ACL if they are not defined. Those will be
 		 * used for user views ACLs too.
 		 */
-		setdefaultacl(voptions, defaultoptions, "allow-query-cache");
-		setdefaultacl(voptions, defaultoptions, "allow-recursion");
-		setdefaultacl(voptions, defaultoptions, "allow-query-cache-on");
-		setdefaultacl(voptions, defaultoptions, "allow-recursion-on");
+		setdefaultacl(voptions, defaultoptions, CFG_CLAUSE_ALLOW_QUERY_CACHE);
+		setdefaultacl(voptions, defaultoptions, CFG_CLAUSE_ALLOW_RECURSION);
+		setdefaultacl(voptions, defaultoptions, CFG_CLAUSE_ALLOW_QUERY_CACHE_ON);
+		setdefaultacl(voptions, defaultoptions, CFG_CLAUSE_ALLOW_RECURSION_ON);
 	}
 }
 
@@ -1370,43 +1371,43 @@ view_merge(const cfg_obj_t *config, cfg_obj_t *eff, const cfg_obj_t *def) {
  * file only.
  */
 static cfg_clausedef_t namedconf_clauses[] = {
-	{ "acl", &cfg_type_acl, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "controls", &cfg_type_controls, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "dnssec-policy", &cfg_type_dnssecpolicy, CFG_CLAUSEFLAG_MULTI,
+	{ CFG_CLAUSE_ACL, &cfg_type_acl, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_CONTROLS, &cfg_type_controls, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_DNSSEC_POLICY, &cfg_type_dnssecpolicy, CFG_CLAUSEFLAG_MULTI,
 	  policy_merge },
 #if HAVE_LIBNGHTTP2
-	{ "http", &cfg_type_http_description,
+	{ CFG_CLAUSE_HTTP, &cfg_type_http_description,
 	  CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_OPTIONAL, NULL },
 #else
-	{ "http", &cfg_type_http_description,
+	{ CFG_CLAUSE_HTTP, &cfg_type_http_description,
 	  CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_NOTCONFIGURED, NULL },
 #endif
-	{ "key-store", &cfg_type_keystore, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "logging", &cfg_type_logging, 0, NULL },
-	{ "lwres", NULL, CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "masters", &cfg_type_serverlist,
+	{ CFG_CLAUSE_KEY_STORE, &cfg_type_keystore, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_LOGGING, &cfg_type_logging, 0, NULL },
+	{ CFG_CLAUSE_LWRES, NULL, CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_MASTERS, &cfg_type_serverlist,
 	  CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_NODOC, NULL },
-	{ "options", &cfg_type_options, 0, options_merge },
-	{ "parental-agents", &cfg_type_serverlist,
+	{ CFG_CLAUSE_OPTIONS, &cfg_type_options, 0, options_merge },
+	{ CFG_CLAUSE_PARENTAL_AGENTS, &cfg_type_serverlist,
 	  CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_NODOC, NULL },
-	{ "primaries", &cfg_type_serverlist,
+	{ CFG_CLAUSE_PRIMARIES, &cfg_type_serverlist,
 	  CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_NODOC, NULL },
-	{ "remote-servers", &cfg_type_serverlist, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_REMOTE_SERVERS, &cfg_type_serverlist, CFG_CLAUSEFLAG_MULTI, NULL },
 #if defined(HAVE_LIBXML2) || defined(HAVE_JSON_C)
-	{ "statistics-channels", &cfg_type_statschannels,
+	{ CFG_CLAUSE_STATISTICS_CHANNELS, &cfg_type_statschannels,
 	  CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_OPTIONAL, NULL },
 #else
-	{ "statistics-channels", &cfg_type_statschannels,
+	{ CFG_CLAUSE_STATISTICS_CHANNELS, &cfg_type_statschannels,
 	  CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_NOTCONFIGURED, NULL },
 #endif
-	{ "template", &cfg_type_template, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "builtin-trust-anchors", &cfg_type_builtin_dnsseckeys,
+	{ CFG_CLAUSE_TEMPLATE, &cfg_type_template, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_BUILTIN_TRUST_ANCHORS, &cfg_type_builtin_dnsseckeys,
 	  CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_BUILTINONLY |
 		  CFG_CLAUSEFLAG_NODOC,
 	  NULL },
-	{ "tls", &cfg_type_tlsconf, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "view", &cfg_type_view, CFG_CLAUSEFLAG_MULTI, view_merge },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE_TLS, &cfg_type_tlsconf, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_VIEW, &cfg_type_view, CFG_CLAUSEFLAG_MULTI, view_merge },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 
 /*%
@@ -1414,19 +1415,19 @@ static cfg_clausedef_t namedconf_clauses[] = {
  * statement, but not in the options block.
  */
 static cfg_clausedef_t namedconf_or_view_clauses[] = {
-	{ "dlz", &cfg_type_dlz, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "dyndb", &cfg_type_dyndb, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "key", &cfg_type_key, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "managed-keys", &cfg_type_dnsseckeys,
+	{ CFG_CLAUSE_DLZ, &cfg_type_dlz, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_DYNDB, &cfg_type_dyndb, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_KEY, &cfg_type_key, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_MANAGED_KEYS, &cfg_type_dnsseckeys,
 	  CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "plugin", &cfg_type_plugin, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "server", &cfg_type_server, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "trust-anchors", &cfg_type_dnsseckeys, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "trusted-keys", NULL, CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_ANCIENT,
+	{ CFG_CLAUSE_PLUGIN, &cfg_type_plugin, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_SERVER, &cfg_type_server, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_TRUST_ANCHORS, &cfg_type_dnsseckeys, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_TRUSTED_KEYS, NULL, CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_ANCIENT,
 	  NULL },
-	{ "zone", &cfg_type_zone, CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_NODOC,
+	{ CFG_CLAUSE_ZONE, &cfg_type_zone, CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_NODOC,
 	  NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 
 /*%
@@ -1434,12 +1435,12 @@ static cfg_clausedef_t namedconf_or_view_clauses[] = {
  * called bind.keys).
  */
 static cfg_clausedef_t bindkeys_clauses[] = {
-	{ "managed-keys", &cfg_type_dnsseckeys,
+	{ CFG_CLAUSE_MANAGED_KEYS, &cfg_type_dnsseckeys,
 	  CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "trust-anchors", &cfg_type_dnsseckeys, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "trusted-keys", NULL, CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_ANCIENT,
+	{ CFG_CLAUSE_TRUST_ANCHORS, &cfg_type_dnsseckeys, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_TRUSTED_KEYS, NULL, CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_ANCIENT,
 	  NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 
 static const char *fstrm_model_enums[] = { "mpsc", "spsc", NULL };
@@ -1452,165 +1453,165 @@ static cfg_type_t cfg_type_fstrm_model = {
  * Clauses that can be found within the 'options' statement.
  */
 static cfg_clausedef_t options_clauses[] = {
-	{ "answer-cookie", &cfg_type_boolean, 0, NULL },
-	{ "automatic-interface-scan", &cfg_type_boolean, 0, NULL },
-	{ "avoid-v4-udp-ports", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "avoid-v6-udp-ports", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "bindkeys-file", &cfg_type_qstring, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "blackhole", &cfg_type_bracketed_aml, 0, NULL },
-	{ "cookie-algorithm", &cfg_type_cookiealg, 0, NULL },
-	{ "cookie-secret", &cfg_type_sstring, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "coresize", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "datasize", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "deallocate-on-exit", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "directory", &cfg_type_qstring, CFG_CLAUSEFLAG_CHDIR, NULL },
-	{ "dnsrps-library", &cfg_type_qstring, CFG_CLAUSEFLAG_OBSOLETE, NULL },
+	{ CFG_CLAUSE_ANSWER_COOKIE, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_AUTOMATIC_INTERFACE_SCAN, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_AVOID_V4_UDP_PORTS, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_AVOID_V6_UDP_PORTS, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_BINDKEYS_FILE, &cfg_type_qstring, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_BLACKHOLE, &cfg_type_bracketed_aml, 0, NULL },
+	{ CFG_CLAUSE_COOKIE_ALGORITHM, &cfg_type_cookiealg, 0, NULL },
+	{ CFG_CLAUSE_COOKIE_SECRET, &cfg_type_sstring, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_CORESIZE, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_DATASIZE, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_DEALLOCATE_ON_EXIT, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_DIRECTORY, &cfg_type_qstring, CFG_CLAUSEFLAG_CHDIR, NULL },
+	{ CFG_CLAUSE_DNSRPS_LIBRARY, &cfg_type_qstring, CFG_CLAUSEFLAG_OBSOLETE, NULL },
 #ifdef HAVE_DNSTAP
-	{ "dnstap-output", &cfg_type_dnstapoutput, CFG_CLAUSEFLAG_OPTIONAL,
+	{ CFG_CLAUSE_DNSTAP_OUTPUT, &cfg_type_dnstapoutput, CFG_CLAUSEFLAG_OPTIONAL,
 	  NULL },
-	{ "dnstap-identity", &cfg_type_serverid, CFG_CLAUSEFLAG_OPTIONAL,
+	{ CFG_CLAUSE_DNSTAP_IDENTITY, &cfg_type_serverid, CFG_CLAUSEFLAG_OPTIONAL,
 	  NULL },
-	{ "dnstap-version", &cfg_type_qstringornone, CFG_CLAUSEFLAG_OPTIONAL,
+	{ CFG_CLAUSE_DNSTAP_VERSION, &cfg_type_qstringornone, CFG_CLAUSEFLAG_OPTIONAL,
 	  NULL },
 #else  /* ifdef HAVE_DNSTAP */
-	{ "dnstap-output", &cfg_type_dnstapoutput, CFG_CLAUSEFLAG_NOTCONFIGURED,
+	{ CFG_CLAUSE_DNSTAP_OUTPUT, &cfg_type_dnstapoutput, CFG_CLAUSEFLAG_NOTCONFIGURED,
 	  NULL },
-	{ "dnstap-identity", &cfg_type_serverid, CFG_CLAUSEFLAG_NOTCONFIGURED,
+	{ CFG_CLAUSE_DNSTAP_IDENTITY, &cfg_type_serverid, CFG_CLAUSEFLAG_NOTCONFIGURED,
 	  NULL },
-	{ "dnstap-version", &cfg_type_qstringornone,
+	{ CFG_CLAUSE_DNSTAP_VERSION, &cfg_type_qstringornone,
 	  CFG_CLAUSEFLAG_NOTCONFIGURED, NULL },
 #endif /* ifdef HAVE_DNSTAP */
-	{ "dscp", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "dump-file", &cfg_type_qstring, 0, NULL },
-	{ "fake-iquery", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "files", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "flush-zones-on-shutdown", &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_DSCP, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_DUMP_FILE, &cfg_type_qstring, 0, NULL },
+	{ CFG_CLAUSE_FAKE_IQUERY, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_FILES, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_FLUSH_ZONES_ON_SHUTDOWN, &cfg_type_boolean, 0, NULL },
 #ifdef HAVE_DNSTAP
-	{ "fstrm-set-buffer-hint", &cfg_type_uint32, CFG_CLAUSEFLAG_OPTIONAL,
+	{ CFG_CLAUSE_FSTRM_SET_BUFFER_HINT, &cfg_type_uint32, CFG_CLAUSEFLAG_OPTIONAL,
 	  NULL },
-	{ "fstrm-set-flush-timeout", &cfg_type_uint32, CFG_CLAUSEFLAG_OPTIONAL,
+	{ CFG_CLAUSE_FSTRM_SET_FLUSH_TIMEOUT, &cfg_type_uint32, CFG_CLAUSEFLAG_OPTIONAL,
 	  NULL },
-	{ "fstrm-set-input-queue-size", &cfg_type_uint32,
+	{ CFG_CLAUSE_FSTRM_SET_INPUT_QUEUE_SIZE, &cfg_type_uint32,
 	  CFG_CLAUSEFLAG_OPTIONAL, NULL },
-	{ "fstrm-set-output-notify-threshold", &cfg_type_uint32,
+	{ CFG_CLAUSE_FSTRM_SET_OUTPUT_NOTIFY_THRESHOLD, &cfg_type_uint32,
 	  CFG_CLAUSEFLAG_OPTIONAL, NULL },
-	{ "fstrm-set-output-queue-model", &cfg_type_fstrm_model,
+	{ CFG_CLAUSE_FSTRM_SET_OUTPUT_QUEUE_MODEL, &cfg_type_fstrm_model,
 	  CFG_CLAUSEFLAG_OPTIONAL, NULL },
-	{ "fstrm-set-output-queue-size", &cfg_type_uint32,
+	{ CFG_CLAUSE_FSTRM_SET_OUTPUT_QUEUE_SIZE, &cfg_type_uint32,
 	  CFG_CLAUSEFLAG_OPTIONAL, NULL },
-	{ "fstrm-set-reopen-interval", &cfg_type_duration,
+	{ CFG_CLAUSE_FSTRM_SET_REOPEN_INTERVAL, &cfg_type_duration,
 	  CFG_CLAUSEFLAG_OPTIONAL, NULL },
 #else  /* ifdef HAVE_DNSTAP */
-	{ "fstrm-set-buffer-hint", &cfg_type_uint32,
+	{ CFG_CLAUSE_FSTRM_SET_BUFFER_HINT, &cfg_type_uint32,
 	  CFG_CLAUSEFLAG_NOTCONFIGURED, NULL },
-	{ "fstrm-set-flush-timeout", &cfg_type_uint32,
+	{ CFG_CLAUSE_FSTRM_SET_FLUSH_TIMEOUT, &cfg_type_uint32,
 	  CFG_CLAUSEFLAG_NOTCONFIGURED, NULL },
-	{ "fstrm-set-input-queue-size", &cfg_type_uint32,
+	{ CFG_CLAUSE_FSTRM_SET_INPUT_QUEUE_SIZE, &cfg_type_uint32,
 	  CFG_CLAUSEFLAG_NOTCONFIGURED, NULL },
-	{ "fstrm-set-output-notify-threshold", &cfg_type_uint32,
+	{ CFG_CLAUSE_FSTRM_SET_OUTPUT_NOTIFY_THRESHOLD, &cfg_type_uint32,
 	  CFG_CLAUSEFLAG_NOTCONFIGURED, NULL },
-	{ "fstrm-set-output-queue-model", &cfg_type_fstrm_model,
+	{ CFG_CLAUSE_FSTRM_SET_OUTPUT_QUEUE_MODEL, &cfg_type_fstrm_model,
 	  CFG_CLAUSEFLAG_NOTCONFIGURED, NULL },
-	{ "fstrm-set-output-queue-size", &cfg_type_uint32,
+	{ CFG_CLAUSE_FSTRM_SET_OUTPUT_QUEUE_SIZE, &cfg_type_uint32,
 	  CFG_CLAUSEFLAG_NOTCONFIGURED, NULL },
-	{ "fstrm-set-reopen-interval", &cfg_type_duration,
+	{ CFG_CLAUSE_FSTRM_SET_REOPEN_INTERVAL, &cfg_type_duration,
 	  CFG_CLAUSEFLAG_NOTCONFIGURED, NULL },
 #endif /* HAVE_DNSTAP */
 #if defined(HAVE_GEOIP2)
-	{ "geoip-directory", &cfg_type_qstringornone, 0, NULL },
+	{ CFG_CLAUSE_GEOIP_DIRECTORY, &cfg_type_qstringornone, 0, NULL },
 #else  /* if defined(HAVE_GEOIP2) */
-	{ "geoip-directory", &cfg_type_qstringornone,
+	{ CFG_CLAUSE_GEOIP_DIRECTORY, &cfg_type_qstringornone,
 	  CFG_CLAUSEFLAG_NOTCONFIGURED, NULL },
 #endif /* HAVE_GEOIP2 */
-	{ "geoip-use-ecs", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "has-old-clients", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "heartbeat-interval", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "host-statistics", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "host-statistics-max", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "hostname", &cfg_type_qstringornone, 0, NULL },
-	{ "interface-interval", &cfg_type_duration, 0, NULL },
-	{ "keep-response-order", &cfg_type_bracketed_aml,
+	{ CFG_CLAUSE_GEOIP_USE_ECS, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_HAS_OLD_CLIENTS, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_HEARTBEAT_INTERVAL, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_HOST_STATISTICS, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_HOST_STATISTICS_MAX, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_HOSTNAME, &cfg_type_qstringornone, 0, NULL },
+	{ CFG_CLAUSE_INTERFACE_INTERVAL, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_KEEP_RESPONSE_ORDER, &cfg_type_bracketed_aml,
 	  CFG_CLAUSEFLAG_OBSOLETE, NULL },
-	{ "listen-on", &cfg_type_listenon, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "listen-on-v6", &cfg_type_listenon, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "lock-file", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "managed-keys-directory", &cfg_type_qstring, 0, NULL },
-	{ "match-mapped-addresses", &cfg_type_boolean, 0, NULL },
-	{ "max-rsa-exponent-size", &cfg_type_uint32, 0, NULL },
-	{ "memstatistics", &cfg_type_boolean, 0, NULL },
-	{ "memstatistics-file", &cfg_type_qstring, 0, NULL },
-	{ "multiple-cnames", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "named-xfer", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "notify-rate", &cfg_type_uint32, 0, NULL },
-	{ "pid-file", &cfg_type_qstringornone, 0, NULL },
-	{ "port", &cfg_type_uint32, 0, NULL },
-	{ "tls-port", &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_LISTEN_ON, &cfg_type_listenon, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_LISTEN_ON_V6, &cfg_type_listenon, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_LOCK_FILE, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_MANAGED_KEYS_DIRECTORY, &cfg_type_qstring, 0, NULL },
+	{ CFG_CLAUSE_MATCH_MAPPED_ADDRESSES, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_MAX_RSA_EXPONENT_SIZE, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_MEMSTATISTICS, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_MEMSTATISTICS_FILE, &cfg_type_qstring, 0, NULL },
+	{ CFG_CLAUSE_MULTIPLE_CNAMES, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_NAMED_XFER, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_NOTIFY_RATE, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_PID_FILE, &cfg_type_qstringornone, 0, NULL },
+	{ CFG_CLAUSE_PORT, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_TLS_PORT, &cfg_type_uint32, 0, NULL },
 #if HAVE_LIBNGHTTP2
-	{ "http-port", &cfg_type_uint32, CFG_CLAUSEFLAG_OPTIONAL, NULL },
-	{ "http-listener-clients", &cfg_type_uint32, CFG_CLAUSEFLAG_OPTIONAL,
+	{ CFG_CLAUSE_HTTP_PORT, &cfg_type_uint32, CFG_CLAUSEFLAG_OPTIONAL, NULL },
+	{ CFG_CLAUSE_HTTP_LISTENER_CLIENTS, &cfg_type_uint32, CFG_CLAUSEFLAG_OPTIONAL,
 	  NULL },
-	{ "http-streams-per-connection", &cfg_type_uint32,
+	{ CFG_CLAUSE_HTTP_STREAMS_PER_CONNECTION, &cfg_type_uint32,
 	  CFG_CLAUSEFLAG_OPTIONAL, NULL },
-	{ "https-port", &cfg_type_uint32, CFG_CLAUSEFLAG_OPTIONAL, NULL },
+	{ CFG_CLAUSE_HTTPS_PORT, &cfg_type_uint32, CFG_CLAUSEFLAG_OPTIONAL, NULL },
 #else
-	{ "http-port", &cfg_type_uint32, CFG_CLAUSEFLAG_NOTCONFIGURED, NULL },
-	{ "http-listener-clients", &cfg_type_uint32,
+	{ CFG_CLAUSE_HTTP_PORT, &cfg_type_uint32, CFG_CLAUSEFLAG_NOTCONFIGURED, NULL },
+	{ CFG_CLAUSE_HTTP_LISTENER_CLIENTS, &cfg_type_uint32,
 	  CFG_CLAUSEFLAG_NOTCONFIGURED, NULL },
-	{ "http-streams-per-connection", &cfg_type_uint32,
+	{ CFG_CLAUSE_HTTP_STREAMS_PER_CONNECTION, &cfg_type_uint32,
 	  CFG_CLAUSEFLAG_NOTCONFIGURED, NULL },
-	{ "https-port", &cfg_type_uint32, CFG_CLAUSEFLAG_NOTCONFIGURED, NULL },
+	{ CFG_CLAUSE_HTTPS_PORT, &cfg_type_uint32, CFG_CLAUSEFLAG_NOTCONFIGURED, NULL },
 #endif
-	{ "querylog", &cfg_type_boolean, 0, NULL },
-	{ "random-device", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "recursing-file", &cfg_type_qstring, 0, NULL },
-	{ "recursive-clients", &cfg_type_uint32, 0, NULL },
-	{ "reuseport", &cfg_type_boolean, 0, NULL },
-	{ "reserved-sockets", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "responselog", &cfg_type_boolean, 0, NULL },
-	{ "secroots-file", &cfg_type_qstring, 0, NULL },
-	{ "serial-queries", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "serial-query-rate", &cfg_type_uint32, 0, NULL },
-	{ "server-id", &cfg_type_serverid, 0, NULL },
-	{ "session-keyalg", &cfg_type_astring, 0, NULL },
-	{ "session-keyfile", &cfg_type_qstringornone, 0, NULL },
-	{ "session-keyname", &cfg_type_astring, 0, NULL },
-	{ "sig0checks-quota", &cfg_type_uint32, CFG_CLAUSEFLAG_EXPERIMENTAL,
+	{ CFG_CLAUSE_QUERYLOG, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_RANDOM_DEVICE, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_RECURSING_FILE, &cfg_type_qstring, 0, NULL },
+	{ CFG_CLAUSE_RECURSIVE_CLIENTS, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_REUSEPORT, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_RESERVED_SOCKETS, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_RESPONSELOG, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_SECROOTS_FILE, &cfg_type_qstring, 0, NULL },
+	{ CFG_CLAUSE_SERIAL_QUERIES, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_SERIAL_QUERY_RATE, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_SERVER_ID, &cfg_type_serverid, 0, NULL },
+	{ CFG_CLAUSE_SESSION_KEYALG, &cfg_type_astring, 0, NULL },
+	{ CFG_CLAUSE_SESSION_KEYFILE, &cfg_type_qstringornone, 0, NULL },
+	{ CFG_CLAUSE_SESSION_KEYNAME, &cfg_type_astring, 0, NULL },
+	{ CFG_CLAUSE_SIG0CHECKS_QUOTA, &cfg_type_uint32, CFG_CLAUSEFLAG_EXPERIMENTAL,
 	  NULL },
-	{ "sig0checks-quota-exempt", &cfg_type_bracketed_aml,
+	{ CFG_CLAUSE_SIG0CHECKS_QUOTA_EXEMPT, &cfg_type_bracketed_aml,
 	  CFG_CLAUSEFLAG_EXPERIMENTAL, NULL },
-	{ "sit-secret", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "stacksize", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "startup-notify-rate", &cfg_type_uint32, 0, NULL },
-	{ "statistics-file", &cfg_type_qstring, 0, NULL },
-	{ "statistics-interval", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "tcp-advertised-timeout", &cfg_type_uint32, 0, NULL },
-	{ "tcp-clients", &cfg_type_uint32, 0, NULL },
-	{ "tcp-idle-timeout", &cfg_type_uint32, 0, NULL },
-	{ "tcp-initial-timeout", &cfg_type_uint32, 0, NULL },
-	{ "tcp-keepalive-timeout", &cfg_type_uint32, 0, NULL },
-	{ "tcp-listen-queue", &cfg_type_uint32, 0, NULL },
-	{ "tcp-primaries-timeout", &cfg_type_uint32, 0, NULL },
-	{ "tcp-receive-buffer", &cfg_type_uint32, 0, NULL },
-	{ "tcp-send-buffer", &cfg_type_uint32, 0, NULL },
-	{ "tkey-dhkey", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "tkey-domain", &cfg_type_qstring, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "tkey-gssapi-credential", &cfg_type_qstring, CFG_CLAUSEFLAG_ANCIENT,
+	{ CFG_CLAUSE_SIT_SECRET, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_STACKSIZE, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_STARTUP_NOTIFY_RATE, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_STATISTICS_FILE, &cfg_type_qstring, 0, NULL },
+	{ CFG_CLAUSE_STATISTICS_INTERVAL, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_TCP_ADVERTISED_TIMEOUT, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_TCP_CLIENTS, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_TCP_IDLE_TIMEOUT, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_TCP_INITIAL_TIMEOUT, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_TCP_KEEPALIVE_TIMEOUT, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_TCP_LISTEN_QUEUE, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_TCP_PRIMARIES_TIMEOUT, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_TCP_RECEIVE_BUFFER, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_TCP_SEND_BUFFER, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_TKEY_DHKEY, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_TKEY_DOMAIN, &cfg_type_qstring, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_TKEY_GSSAPI_CREDENTIAL, &cfg_type_qstring, CFG_CLAUSEFLAG_ANCIENT,
 	  NULL },
-	{ "tkey-gssapi-keytab", &cfg_type_qstring, 0, NULL },
-	{ "transfer-message-size", &cfg_type_uint32, 0, NULL },
-	{ "transfers-in", &cfg_type_uint32, 0, NULL },
-	{ "transfers-out", &cfg_type_uint32, 0, NULL },
-	{ "transfers-per-ns", &cfg_type_uint32, 0, NULL },
-	{ "treat-cr-as-space", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "udp-receive-buffer", &cfg_type_uint32, 0, NULL },
-	{ "udp-send-buffer", &cfg_type_uint32, 0, NULL },
-	{ "update-quota", &cfg_type_uint32, 0, NULL },
-	{ "use-id-pool", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "use-ixfr", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "use-v4-udp-ports", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "use-v6-udp-ports", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "version", &cfg_type_qstringornone, 0, NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE_TKEY_GSSAPI_KEYTAB, &cfg_type_qstring, 0, NULL },
+	{ CFG_CLAUSE_TRANSFER_MESSAGE_SIZE, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_TRANSFERS_IN, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_TRANSFERS_OUT, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_TRANSFERS_PER_NS, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_TREAT_CR_AS_SPACE, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_UDP_RECEIVE_BUFFER, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_UDP_SEND_BUFFER, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_UPDATE_QUOTA, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_USE_ID_POOL, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_USE_IXFR, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_USE_V4_UDP_PORTS, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_USE_V6_UDP_PORTS, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_VERSION, &cfg_type_qstringornone, 0, NULL },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 
 static cfg_type_t cfg_type_namelist = { "namelist",
@@ -2152,22 +2153,22 @@ static cfg_type_t cfg_type_catz = {
  * rate-limit
  */
 static cfg_clausedef_t rrl_clauses[] = {
-	{ "all-per-second", &cfg_type_uint32, 0, NULL },
-	{ "errors-per-second", &cfg_type_uint32, 0, NULL },
-	{ "exempt-clients", &cfg_type_bracketed_aml, 0, NULL },
-	{ "ipv4-prefix-length", &cfg_type_uint32, 0, NULL },
-	{ "ipv6-prefix-length", &cfg_type_uint32, 0, NULL },
-	{ "log-only", &cfg_type_boolean, 0, NULL },
-	{ "max-table-size", &cfg_type_uint32, 0, NULL },
-	{ "min-table-size", &cfg_type_uint32, 0, NULL },
-	{ "nodata-per-second", &cfg_type_uint32, 0, NULL },
-	{ "nxdomains-per-second", &cfg_type_uint32, 0, NULL },
-	{ "qps-scale", &cfg_type_uint32, 0, NULL },
-	{ "referrals-per-second", &cfg_type_uint32, 0, NULL },
-	{ "responses-per-second", &cfg_type_uint32, 0, NULL },
-	{ "slip", &cfg_type_uint32, 0, NULL },
-	{ "window", &cfg_type_uint32, 0, NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE_ALL_PER_SECOND, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_ERRORS_PER_SECOND, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_EXEMPT_CLIENTS, &cfg_type_bracketed_aml, 0, NULL },
+	{ CFG_CLAUSE_IPV4_PREFIX_LENGTH, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_IPV6_PREFIX_LENGTH, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_LOG_ONLY, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_MAX_TABLE_SIZE, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_MIN_TABLE_SIZE, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_NODATA_PER_SECOND, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_NXDOMAINS_PER_SECOND, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_QPS_SCALE, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_REFERRALS_PER_SECOND, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_RESPONSES_PER_SECOND, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_SLIP, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_WINDOW, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 
 static cfg_clausedef_t *rrl_clausesets[] = { rrl_clauses, NULL };
@@ -2217,13 +2218,13 @@ static cfg_type_t cfg_type_prefetch = { "prefetch",	 cfg_parse_tuple,
  * DNS64.
  */
 static cfg_clausedef_t dns64_clauses[] = {
-	{ "break-dnssec", &cfg_type_boolean, 0, NULL },
-	{ "clients", &cfg_type_bracketed_aml, 0, NULL },
-	{ "exclude", &cfg_type_bracketed_aml, 0, NULL },
-	{ "mapped", &cfg_type_bracketed_aml, 0, NULL },
-	{ "recursive-only", &cfg_type_boolean, 0, NULL },
-	{ "suffix", &cfg_type_netaddr6, 0, NULL },
-	{ NULL, NULL, 0, NULL },
+	{ CFG_CLAUSE_BREAK_DNSSEC, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_CLIENTS, &cfg_type_bracketed_aml, 0, NULL },
+	{ CFG_CLAUSE_EXCLUDE, &cfg_type_bracketed_aml, 0, NULL },
+	{ CFG_CLAUSE_MAPPED, &cfg_type_bracketed_aml, 0, NULL },
+	{ CFG_CLAUSE_RECURSIVE_ONLY, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_SUFFIX, &cfg_type_netaddr6, 0, NULL },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL },
 };
 
 static cfg_clausedef_t *dns64_clausesets[] = { dns64_clauses, NULL };
@@ -2323,161 +2324,161 @@ checknames_merge(const cfg_obj_t *config ISC_ATTR_UNUSED,
  */
 
 static cfg_clausedef_t view_clauses[] = {
-	{ "acache-cleaning-interval", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "acache-enable", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "additional-from-auth", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "additional-from-cache", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "allow-new-zones", &cfg_type_boolean, 0, NULL },
-	{ "allow-proxy", &cfg_type_bracketed_aml, CFG_CLAUSEFLAG_EXPERIMENTAL,
+	{ CFG_CLAUSE_ACACHE_CLEANING_INTERVAL, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_ACACHE_ENABLE, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_ADDITIONAL_FROM_AUTH, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_ADDITIONAL_FROM_CACHE, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_ALLOW_NEW_ZONES, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_ALLOW_PROXY, &cfg_type_bracketed_aml, CFG_CLAUSEFLAG_EXPERIMENTAL,
 	  NULL },
-	{ "allow-proxy-on", &cfg_type_bracketed_aml,
+	{ CFG_CLAUSE_ALLOW_PROXY_ON, &cfg_type_bracketed_aml,
 	  CFG_CLAUSEFLAG_EXPERIMENTAL, NULL },
-	{ "allow-query-cache", &cfg_type_bracketed_aml, 0, NULL },
-	{ "allow-query-cache-on", &cfg_type_bracketed_aml, 0, NULL },
-	{ "allow-recursion", &cfg_type_bracketed_aml, 0, NULL },
-	{ "allow-recursion-on", &cfg_type_bracketed_aml, 0, NULL },
-	{ "allow-v6-synthesis", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "attach-cache", &cfg_type_astring, 0, NULL },
-	{ "auth-nxdomain", &cfg_type_boolean, 0, NULL },
-	{ "cache-file", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "catalog-zones", &cfg_type_catz, 0, NULL },
-	{ "check-names", &cfg_type_checknames, CFG_CLAUSEFLAG_MULTI,
+	{ CFG_CLAUSE_ALLOW_QUERY_CACHE, &cfg_type_bracketed_aml, 0, NULL },
+	{ CFG_CLAUSE_ALLOW_QUERY_CACHE_ON, &cfg_type_bracketed_aml, 0, NULL },
+	{ CFG_CLAUSE_ALLOW_RECURSION, &cfg_type_bracketed_aml, 0, NULL },
+	{ CFG_CLAUSE_ALLOW_RECURSION_ON, &cfg_type_bracketed_aml, 0, NULL },
+	{ CFG_CLAUSE_ALLOW_V6_SYNTHESIS, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_ATTACH_CACHE, &cfg_type_astring, 0, NULL },
+	{ CFG_CLAUSE_AUTH_NXDOMAIN, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_CACHE_FILE, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_CATALOG_ZONES, &cfg_type_catz, 0, NULL },
+	{ CFG_CLAUSE_CHECK_NAMES, &cfg_type_checknames, CFG_CLAUSEFLAG_MULTI,
 	  checknames_merge },
-	{ "cleaning-interval", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "clients-per-query", &cfg_type_uint32, 0, NULL },
-	{ "deny-answer-addresses", &cfg_type_denyaddresses, 0, NULL },
-	{ "deny-answer-aliases", &cfg_type_denyaliases, 0, NULL },
-	{ "disable-algorithms", &cfg_type_disablealgorithm,
+	{ CFG_CLAUSE_CLEANING_INTERVAL, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_CLIENTS_PER_QUERY, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_DENY_ANSWER_ADDRESSES, &cfg_type_denyaddresses, 0, NULL },
+	{ CFG_CLAUSE_DENY_ANSWER_ALIASES, &cfg_type_denyaliases, 0, NULL },
+	{ CFG_CLAUSE_DISABLE_ALGORITHMS, &cfg_type_disablealgorithm,
 	  CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "disable-ds-digests", &cfg_type_disabledsdigest, CFG_CLAUSEFLAG_MULTI,
+	{ CFG_CLAUSE_DISABLE_DS_DIGESTS, &cfg_type_disabledsdigest, CFG_CLAUSEFLAG_MULTI,
 	  NULL },
-	{ "disable-empty-zone", &cfg_type_astring, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "dns64", &cfg_type_dns64, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "dns64-contact", &cfg_type_astring, 0, NULL },
-	{ "dns64-server", &cfg_type_astring, 0, NULL },
-	{ "dnsrps-enable", &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE, NULL },
-	{ "dnsrps-options", &cfg_type_bracketed_text, CFG_CLAUSEFLAG_OBSOLETE,
+	{ CFG_CLAUSE_DISABLE_EMPTY_ZONE, &cfg_type_astring, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_DNS64, &cfg_type_dns64, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_DNS64_CONTACT, &cfg_type_astring, 0, NULL },
+	{ CFG_CLAUSE_DNS64_SERVER, &cfg_type_astring, 0, NULL },
+	{ CFG_CLAUSE_DNSRPS_ENABLE, &cfg_type_boolean, CFG_CLAUSEFLAG_OBSOLETE, NULL },
+	{ CFG_CLAUSE_DNSRPS_OPTIONS, &cfg_type_bracketed_text, CFG_CLAUSEFLAG_OBSOLETE,
 	  NULL },
-	{ "dnssec-accept-expired", &cfg_type_boolean, 0, NULL },
-	{ "dnssec-enable", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "dnssec-lookaside", NULL,
+	{ CFG_CLAUSE_DNSSEC_ACCEPT_EXPIRED, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_DNSSEC_ENABLE, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_DNSSEC_LOOKASIDE, NULL,
 	  CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "dnssec-must-be-secure", NULL,
+	{ CFG_CLAUSE_DNSSEC_MUST_BE_SECURE, NULL,
 	  CFG_CLAUSEFLAG_MULTI | CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "dnssec-validation", &cfg_type_boolorauto, 0, NULL },
+	{ CFG_CLAUSE_DNSSEC_VALIDATION, &cfg_type_boolorauto, 0, NULL },
 #ifdef HAVE_DNSTAP
-	{ "dnstap", &cfg_type_dnstap, CFG_CLAUSEFLAG_OPTIONAL, NULL },
+	{ CFG_CLAUSE_DNSTAP, &cfg_type_dnstap, CFG_CLAUSEFLAG_OPTIONAL, NULL },
 #else  /* ifdef HAVE_DNSTAP */
-	{ "dnstap", &cfg_type_dnstap, CFG_CLAUSEFLAG_NOTCONFIGURED, NULL },
+	{ CFG_CLAUSE_DNSTAP, &cfg_type_dnstap, CFG_CLAUSEFLAG_NOTCONFIGURED, NULL },
 #endif /* HAVE_DNSTAP */
-	{ "dual-stack-servers", &cfg_type_nameportiplist, 0, NULL },
-	{ "edns-udp-size", &cfg_type_uint32, 0, NULL },
-	{ "empty-contact", &cfg_type_astring, 0, NULL },
-	{ "empty-server", &cfg_type_astring, 0, NULL },
-	{ "empty-zones-enable", &cfg_type_boolean, 0, NULL },
-	{ "fetch-glue", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "fetch-quota-params", &cfg_type_fetchquota, 0, NULL },
-	{ "fetches-per-server", &cfg_type_fetchesper, 0, NULL },
-	{ "fetches-per-zone", &cfg_type_fetchesper, 0, NULL },
-	{ "filter-aaaa", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "filter-aaaa-on-v4", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "filter-aaaa-on-v6", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "glue-cache", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "ipv4only-enable", &cfg_type_boolean, 0, NULL },
-	{ "ipv4only-contact", &cfg_type_astring, 0, NULL },
-	{ "ipv4only-server", &cfg_type_astring, 0, NULL },
-	{ "ixfr-from-differences", &cfg_type_ixfrdifftype, 0, NULL },
-	{ "lame-ttl", &cfg_type_duration, 0, NULL },
-	{ "lmdb-mapsize", &cfg_type_sizeval, CFG_CLAUSEFLAG_OPTIONAL, NULL },
-	{ "max-acache-size", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "max-cache-size", &cfg_type_maxcachesize, 0, NULL },
-	{ "max-cache-ttl", &cfg_type_duration, 0, NULL },
-	{ "max-clients-per-query", &cfg_type_uint32, 0, NULL },
-	{ "max-delegation-servers", &cfg_type_uint32,
+	{ CFG_CLAUSE_DUAL_STACK_SERVERS, &cfg_type_nameportiplist, 0, NULL },
+	{ CFG_CLAUSE_EDNS_UDP_SIZE, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_EMPTY_CONTACT, &cfg_type_astring, 0, NULL },
+	{ CFG_CLAUSE_EMPTY_SERVER, &cfg_type_astring, 0, NULL },
+	{ CFG_CLAUSE_EMPTY_ZONES_ENABLE, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_FETCH_GLUE, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_FETCH_QUOTA_PARAMS, &cfg_type_fetchquota, 0, NULL },
+	{ CFG_CLAUSE_FETCHES_PER_SERVER, &cfg_type_fetchesper, 0, NULL },
+	{ CFG_CLAUSE_FETCHES_PER_ZONE, &cfg_type_fetchesper, 0, NULL },
+	{ CFG_CLAUSE_FILTER_AAAA, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_FILTER_AAAA_ON_V4, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_FILTER_AAAA_ON_V6, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_GLUE_CACHE, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_IPV4ONLY_ENABLE, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_IPV4ONLY_CONTACT, &cfg_type_astring, 0, NULL },
+	{ CFG_CLAUSE_IPV4ONLY_SERVER, &cfg_type_astring, 0, NULL },
+	{ CFG_CLAUSE_IXFR_FROM_DIFFERENCES, &cfg_type_ixfrdifftype, 0, NULL },
+	{ CFG_CLAUSE_LAME_TTL, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_LMDB_MAPSIZE, &cfg_type_sizeval, CFG_CLAUSEFLAG_OPTIONAL, NULL },
+	{ CFG_CLAUSE_MAX_ACACHE_SIZE, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_MAX_CACHE_SIZE, &cfg_type_maxcachesize, 0, NULL },
+	{ CFG_CLAUSE_MAX_CACHE_TTL, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_MAX_CLIENTS_PER_QUERY, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_MAX_DELEGATION_SERVERS, &cfg_type_uint32,
 	  CFG_CLAUSEFLAG_EXPERIMENTAL, NULL },
-	{ "max-ncache-ttl", &cfg_type_duration, 0, NULL },
-	{ "max-recursion-depth", &cfg_type_uint32, 0, NULL },
-	{ "max-recursion-queries", &cfg_type_uint32, 0, NULL },
-	{ "max-query-count", &cfg_type_uint32, 0, NULL },
-	{ "max-query-restarts", &cfg_type_uint32, 0, NULL },
-	{ "max-stale-ttl", &cfg_type_duration, 0, NULL },
-	{ "max-udp-size", &cfg_type_uint32, 0, NULL },
-	{ "max-validations-per-fetch", &cfg_type_uint32,
+	{ CFG_CLAUSE_MAX_NCACHE_TTL, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_MAX_RECURSION_DEPTH, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_MAX_RECURSION_QUERIES, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_MAX_QUERY_COUNT, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_MAX_QUERY_RESTARTS, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_MAX_STALE_TTL, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_MAX_UDP_SIZE, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_MAX_VALIDATIONS_PER_FETCH, &cfg_type_uint32,
 	  CFG_CLAUSEFLAG_EXPERIMENTAL, NULL },
-	{ "max-validation-failures-per-fetch", &cfg_type_uint32,
+	{ CFG_CLAUSE_MAX_VALIDATION_FAILURES_PER_FETCH, &cfg_type_uint32,
 	  CFG_CLAUSEFLAG_EXPERIMENTAL, NULL },
-	{ "message-compression", &cfg_type_boolean, 0, NULL },
-	{ "min-cache-ttl", &cfg_type_duration, 0, NULL },
-	{ "min-ncache-ttl", &cfg_type_duration, 0, NULL },
-	{ "min-roots", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "minimal-any", &cfg_type_boolean, 0, NULL },
-	{ "minimal-responses", &cfg_type_minimal, 0, NULL },
-	{ "new-zones-directory", &cfg_type_qstring, 0, NULL },
-	{ "no-case-compress", &cfg_type_bracketed_aml, 0, NULL },
-	{ "nocookie-udp-size", &cfg_type_uint32, 0, NULL },
-	{ "nosit-udp-size", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "nta-lifetime", &cfg_type_duration, 0, NULL },
-	{ "nta-recheck", &cfg_type_duration, 0, NULL },
-	{ "nxdomain-redirect", &cfg_type_astring, 0, NULL },
-	{ "preferred-glue", &cfg_type_astring, 0, NULL },
-	{ "prefetch", &cfg_type_prefetch, 0, prefetch_merge },
-	{ "provide-ixfr", &cfg_type_boolean, 0, NULL },
-	{ "qname-minimization", &cfg_type_qminmethod, 0, NULL },
+	{ CFG_CLAUSE_MESSAGE_COMPRESSION, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_MIN_CACHE_TTL, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_MIN_NCACHE_TTL, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_MIN_ROOTS, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_MINIMAL_ANY, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_MINIMAL_RESPONSES, &cfg_type_minimal, 0, NULL },
+	{ CFG_CLAUSE_NEW_ZONES_DIRECTORY, &cfg_type_qstring, 0, NULL },
+	{ CFG_CLAUSE_NO_CASE_COMPRESS, &cfg_type_bracketed_aml, 0, NULL },
+	{ CFG_CLAUSE_NOCOOKIE_UDP_SIZE, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_NOSIT_UDP_SIZE, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_NTA_LIFETIME, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_NTA_RECHECK, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_NXDOMAIN_REDIRECT, &cfg_type_astring, 0, NULL },
+	{ CFG_CLAUSE_PREFERRED_GLUE, &cfg_type_astring, 0, NULL },
+	{ CFG_CLAUSE_PREFETCH, &cfg_type_prefetch, 0, prefetch_merge },
+	{ CFG_CLAUSE_PROVIDE_IXFR, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_QNAME_MINIMIZATION, &cfg_type_qminmethod, 0, NULL },
 	/*
 	 * Note that the query-source option syntax is different
 	 * from the other -source options.
 	 */
-	{ "query-source", &cfg_type_querysource4, 0, NULL },
-	{ "query-source-v6", &cfg_type_querysource6, 0, NULL },
-	{ "queryport-pool-ports", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "queryport-pool-updateinterval", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "rate-limit", &cfg_type_rrl, 0, NULL },
-	{ "recursion", &cfg_type_boolean, 0, NULL },
-	{ "request-nsid", &cfg_type_boolean, 0, NULL },
-	{ "request-sit", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "request-zoneversion", &cfg_type_boolean, 0, NULL },
-	{ "require-server-cookie", &cfg_type_boolean, 0, NULL },
-	{ "resolver-nonbackoff-tries", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "resolver-query-timeout", &cfg_type_uint32, 0, NULL },
-	{ "resolver-retry-interval", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "response-padding", &cfg_type_resppadding, 0, NULL },
-	{ "response-policy", &cfg_type_rpz, 0, NULL },
-	{ "rfc2308-type1", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "root-delegation-only", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "root-key-sentinel", &cfg_type_boolean, 0, NULL },
-	{ "rrset-order", &cfg_type_rrsetorder, 0, NULL },
-	{ "send-cookie", &cfg_type_boolean, 0, NULL },
-	{ "servfail-ttl", &cfg_type_duration, 0, NULL },
-	{ "sig0key-checks-limit", &cfg_type_uint32, 0, NULL },
-	{ "sig0message-checks-limit", &cfg_type_uint32, 0, NULL },
-	{ "sortlist", &cfg_type_bracketed_aml, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "stale-answer-enable", &cfg_type_boolean, 0, NULL },
-	{ "stale-answer-client-timeout", &cfg_type_staleanswerclienttimeout, 0,
+	{ CFG_CLAUSE_QUERY_SOURCE, &cfg_type_querysource4, 0, NULL },
+	{ CFG_CLAUSE_QUERY_SOURCE_V6, &cfg_type_querysource6, 0, NULL },
+	{ CFG_CLAUSE_QUERYPORT_POOL_PORTS, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_QUERYPORT_POOL_UPDATEINTERVAL, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_RATE_LIMIT, &cfg_type_rrl, 0, NULL },
+	{ CFG_CLAUSE_RECURSION, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_REQUEST_NSID, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_REQUEST_SIT, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_REQUEST_ZONEVERSION, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_REQUIRE_SERVER_COOKIE, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_RESOLVER_NONBACKOFF_TRIES, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_RESOLVER_QUERY_TIMEOUT, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_RESOLVER_RETRY_INTERVAL, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_RESPONSE_PADDING, &cfg_type_resppadding, 0, NULL },
+	{ CFG_CLAUSE_RESPONSE_POLICY, &cfg_type_rpz, 0, NULL },
+	{ CFG_CLAUSE_RFC2308_TYPE1, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_ROOT_DELEGATION_ONLY, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_ROOT_KEY_SENTINEL, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_RRSET_ORDER, &cfg_type_rrsetorder, 0, NULL },
+	{ CFG_CLAUSE_SEND_COOKIE, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_SERVFAIL_TTL, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_SIG0KEY_CHECKS_LIMIT, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_SIG0MESSAGE_CHECKS_LIMIT, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_SORTLIST, &cfg_type_bracketed_aml, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_STALE_ANSWER_ENABLE, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_STALE_ANSWER_CLIENT_TIMEOUT, &cfg_type_staleanswerclienttimeout, 0,
 	  NULL },
-	{ "stale-answer-ttl", &cfg_type_duration, 0, NULL },
-	{ "stale-cache-enable", &cfg_type_boolean, 0, NULL },
-	{ "stale-refresh-time", &cfg_type_duration, 0, NULL },
-	{ "suppress-initial-notify", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "synth-from-dnssec", &cfg_type_boolean, 0, NULL },
-	{ "topology", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "transfer-format", &cfg_type_transferformat, 0, NULL },
-	{ "trust-anchor-telemetry", &cfg_type_boolean, 0, NULL },
-	{ "resolver-use-dns64", &cfg_type_boolean, 0, NULL },
-	{ "use-queryport-pool", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "validate-except", &cfg_type_namelist, 0, NULL },
-	{ "v6-bias", &cfg_type_uint32, 0, NULL },
-	{ "zero-no-soa-ttl-cache", &cfg_type_boolean, 0, NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE_STALE_ANSWER_TTL, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_STALE_CACHE_ENABLE, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_STALE_REFRESH_TIME, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_SUPPRESS_INITIAL_NOTIFY, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_SYNTH_FROM_DNSSEC, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_TOPOLOGY, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_TRANSFER_FORMAT, &cfg_type_transferformat, 0, NULL },
+	{ CFG_CLAUSE_TRUST_ANCHOR_TELEMETRY, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_RESOLVER_USE_DNS64, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_USE_QUERYPORT_POOL, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_VALIDATE_EXCEPT, &cfg_type_namelist, 0, NULL },
+	{ CFG_CLAUSE_V6_BIAS, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_ZERO_NO_SOA_TTL_CACHE, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 
 /*%
  * Clauses that can be found within the 'view' statement only.
  */
 static cfg_clausedef_t view_only_clauses[] = {
-	{ "match-clients", &cfg_type_bracketed_aml, 0, NULL },
-	{ "match-destinations", &cfg_type_bracketed_aml, 0, NULL },
-	{ "match-recursive-only", &cfg_type_boolean, 0, NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE_MATCH_CLIENTS, &cfg_type_bracketed_aml, 0, NULL },
+	{ CFG_CLAUSE_MATCH_DESTINATIONS, &cfg_type_bracketed_aml, 0, NULL },
+	{ CFG_CLAUSE_MATCH_RECURSIVE_ONLY, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 
 /*%
@@ -2517,27 +2518,27 @@ static cfg_type_t cfg_type_checkdstype = {
  * Clauses that can be found in a 'dnssec-policy' statement.
  */
 static cfg_clausedef_t dnssecpolicy_clauses[] = {
-	{ "cdnskey", &cfg_type_boolean, 0, NULL },
-	{ "cds-digest-types", &cfg_type_algorithmlist, 0, NULL },
-	{ "dnskey-ttl", &cfg_type_duration, 0, NULL },
-	{ "inline-signing", &cfg_type_boolean, 0, NULL },
-	{ "keys", &cfg_type_kaspkeys, 0, NULL },
-	{ "manual-mode", &cfg_type_boolean, 0, NULL },
-	{ "max-zone-ttl", &cfg_type_duration, 0, NULL },
-	{ "nsec3param", &cfg_type_nsec3, 0, NULL },
-	{ "offline-ksk", &cfg_type_boolean, 0, NULL },
-	{ "parent-ds-ttl", &cfg_type_duration, 0, NULL },
-	{ "parent-propagation-delay", &cfg_type_duration, 0, NULL },
-	{ "parent-registration-delay", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "publish-safety", &cfg_type_duration, 0, NULL },
-	{ "purge-keys", &cfg_type_duration, 0, NULL },
-	{ "retire-safety", &cfg_type_duration, 0, NULL },
-	{ "signatures-jitter", &cfg_type_duration, 0, NULL },
-	{ "signatures-refresh", &cfg_type_duration, 0, NULL },
-	{ "signatures-validity", &cfg_type_duration, 0, NULL },
-	{ "signatures-validity-dnskey", &cfg_type_duration, 0, NULL },
-	{ "zone-propagation-delay", &cfg_type_duration, 0, NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE_CDNSKEY, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_CDS_DIGEST_TYPES, &cfg_type_algorithmlist, 0, NULL },
+	{ CFG_CLAUSE_DNSKEY_TTL, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_INLINE_SIGNING, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_KEYS, &cfg_type_kaspkeys, 0, NULL },
+	{ CFG_CLAUSE_MANUAL_MODE, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_MAX_ZONE_TTL, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_NSEC3PARAM, &cfg_type_nsec3, 0, NULL },
+	{ CFG_CLAUSE_OFFLINE_KSK, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_PARENT_DS_TTL, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_PARENT_PROPAGATION_DELAY, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_PARENT_REGISTRATION_DELAY, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_PUBLISH_SAFETY, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_PURGE_KEYS, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_RETIRE_SAFETY, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_SIGNATURES_JITTER, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_SIGNATURES_REFRESH, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_SIGNATURES_VALIDITY, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_SIGNATURES_VALIDITY_DNSKEY, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE_ZONE_PROPAGATION_DELAY, &cfg_type_duration, 0, NULL },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 
 /*
@@ -2569,185 +2570,185 @@ static cfg_type_t cfg_type_min_transfer_rate_in = {
  * Example: allow-transfer port 853 protocol tls { ... };
  */
 static cfg_clausedef_t zone_clauses[] = {
-	{ "allow-notify", &cfg_type_bracketed_aml,
+	{ CFG_CLAUSE_ALLOW_NOTIFY, &cfg_type_bracketed_aml,
 	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR, NULL },
-	{ "allow-query", &cfg_type_bracketed_aml,
+	{ CFG_CLAUSE_ALLOW_QUERY, &cfg_type_bracketed_aml,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
 		  CFG_ZONE_STUB | CFG_ZONE_REDIRECT | CFG_ZONE_STATICSTUB,
 	  NULL },
-	{ "allow-query-on", &cfg_type_bracketed_aml,
+	{ CFG_CLAUSE_ALLOW_QUERY_ON, &cfg_type_bracketed_aml,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
 		  CFG_ZONE_STUB | CFG_ZONE_REDIRECT | CFG_ZONE_STATICSTUB,
 	  NULL },
-	{ "allow-transfer", &cfg_type_transport_acl,
+	{ CFG_CLAUSE_ALLOW_TRANSFER, &cfg_type_transport_acl,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR, NULL },
-	{ "allow-update", &cfg_type_bracketed_aml, CFG_ZONE_PRIMARY, NULL },
-	{ "allow-update-forwarding", &cfg_type_bracketed_aml,
+	{ CFG_CLAUSE_ALLOW_UPDATE, &cfg_type_bracketed_aml, CFG_ZONE_PRIMARY, NULL },
+	{ CFG_CLAUSE_ALLOW_UPDATE_FORWARDING, &cfg_type_bracketed_aml,
 	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR, NULL },
-	{ "also-notify", &cfg_type_namesockaddrkeylist,
+	{ CFG_CLAUSE_ALSO_NOTIFY, &cfg_type_namesockaddrkeylist,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR, NULL },
-	{ "alt-transfer-source", NULL,
+	{ CFG_CLAUSE_ALT_TRANSFER_SOURCE, NULL,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
 		  CFG_CLAUSEFLAG_ANCIENT,
 	  NULL },
-	{ "alt-transfer-source-v6", NULL,
+	{ CFG_CLAUSE_ALT_TRANSFER_SOURCE_V6, NULL,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
 		  CFG_CLAUSEFLAG_ANCIENT,
 	  NULL },
-	{ "auto-dnssec", NULL,
+	{ CFG_CLAUSE_AUTO_DNSSEC, NULL,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_CLAUSEFLAG_ANCIENT,
 	  NULL },
-	{ "check-dup-records", &cfg_type_checkmode, CFG_ZONE_PRIMARY, NULL },
-	{ "check-integrity", &cfg_type_boolean, CFG_ZONE_PRIMARY, NULL },
-	{ "check-mx", &cfg_type_checkmode, CFG_ZONE_PRIMARY, NULL },
-	{ "check-mx-cname", &cfg_type_checkmode, CFG_ZONE_PRIMARY, NULL },
-	{ "check-sibling", &cfg_type_boolean, CFG_ZONE_PRIMARY, NULL },
-	{ "check-spf", &cfg_type_warn, CFG_ZONE_PRIMARY, NULL },
-	{ "check-srv-cname", &cfg_type_checkmode, CFG_ZONE_PRIMARY, NULL },
-	{ "check-svcb", &cfg_type_boolean, CFG_ZONE_PRIMARY, NULL },
-	{ "check-wildcard", &cfg_type_boolean, CFG_ZONE_PRIMARY, NULL },
-	{ "dialup", NULL,
+	{ CFG_CLAUSE_CHECK_DUP_RECORDS, &cfg_type_checkmode, CFG_ZONE_PRIMARY, NULL },
+	{ CFG_CLAUSE_CHECK_INTEGRITY, &cfg_type_boolean, CFG_ZONE_PRIMARY, NULL },
+	{ CFG_CLAUSE_CHECK_MX, &cfg_type_checkmode, CFG_ZONE_PRIMARY, NULL },
+	{ CFG_CLAUSE_CHECK_MX_CNAME, &cfg_type_checkmode, CFG_ZONE_PRIMARY, NULL },
+	{ CFG_CLAUSE_CHECK_SIBLING, &cfg_type_boolean, CFG_ZONE_PRIMARY, NULL },
+	{ CFG_CLAUSE_CHECK_SPF, &cfg_type_warn, CFG_ZONE_PRIMARY, NULL },
+	{ CFG_CLAUSE_CHECK_SRV_CNAME, &cfg_type_checkmode, CFG_ZONE_PRIMARY, NULL },
+	{ CFG_CLAUSE_CHECK_SVCB, &cfg_type_boolean, CFG_ZONE_PRIMARY, NULL },
+	{ CFG_CLAUSE_CHECK_WILDCARD, &cfg_type_boolean, CFG_ZONE_PRIMARY, NULL },
+	{ CFG_CLAUSE_DIALUP, NULL,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_STUB |
 		  CFG_CLAUSEFLAG_ANCIENT,
 	  NULL },
-	{ "dnssec-dnskey-kskonly", &cfg_type_boolean,
+	{ CFG_CLAUSE_DNSSEC_DNSKEY_KSKONLY, &cfg_type_boolean,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_CLAUSEFLAG_OBSOLETE,
 	  NULL },
-	{ "dnssec-loadkeys-interval", &cfg_type_uint32,
+	{ CFG_CLAUSE_DNSSEC_LOADKEYS_INTERVAL, &cfg_type_uint32,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY, NULL },
-	{ "dnssec-policy", &cfg_type_astring,
+	{ CFG_CLAUSE_DNSSEC_POLICY, &cfg_type_astring,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY, NULL },
-	{ "dnssec-secure-to-insecure", &cfg_type_boolean,
+	{ CFG_CLAUSE_DNSSEC_SECURE_TO_INSECURE, &cfg_type_boolean,
 	  CFG_ZONE_PRIMARY | CFG_CLAUSEFLAG_OBSOLETE, NULL },
-	{ "dnssec-update-mode", &cfg_type_dnssecupdatemode,
+	{ CFG_CLAUSE_DNSSEC_UPDATE_MODE, &cfg_type_dnssecupdatemode,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_CLAUSEFLAG_OBSOLETE,
 	  NULL },
-	{ "forward", &cfg_type_forwardtype,
+	{ CFG_CLAUSE_FORWARD, &cfg_type_forwardtype,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_STUB |
 		  CFG_ZONE_STATICSTUB | CFG_ZONE_FORWARD,
 	  NULL },
-	{ "forwarders", &cfg_type_portiplist,
+	{ CFG_CLAUSE_FORWARDERS, &cfg_type_portiplist,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_STUB |
 		  CFG_ZONE_STATICSTUB | CFG_ZONE_FORWARD,
 	  NULL },
-	{ "key-directory", &cfg_type_qstring,
+	{ CFG_CLAUSE_KEY_DIRECTORY, &cfg_type_qstring,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY, NULL },
-	{ "maintain-ixfr-base", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "masterfile-format", &cfg_type_masterformat,
+	{ CFG_CLAUSE_MAINTAIN_IXFR_BASE, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_MASTERFILE_FORMAT, &cfg_type_masterformat,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
 		  CFG_ZONE_STUB | CFG_ZONE_REDIRECT,
 	  NULL },
-	{ "masterfile-style", &cfg_type_masterstyle,
+	{ CFG_CLAUSE_MASTERFILE_STYLE, &cfg_type_masterstyle,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
 		  CFG_ZONE_STUB | CFG_ZONE_REDIRECT,
 	  NULL },
-	{ "max-ixfr-log-size", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "max-ixfr-ratio", &cfg_type_ixfrratio,
+	{ CFG_CLAUSE_MAX_IXFR_LOG_SIZE, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_MAX_IXFR_RATIO, &cfg_type_ixfrratio,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR, NULL },
-	{ "max-journal-size", &cfg_type_size,
+	{ CFG_CLAUSE_MAX_JOURNAL_SIZE, &cfg_type_size,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR, NULL },
-	{ "max-records", &cfg_type_uint32,
+	{ CFG_CLAUSE_MAX_RECORDS, &cfg_type_uint32,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
 		  CFG_ZONE_STUB | CFG_ZONE_STATICSTUB | CFG_ZONE_REDIRECT,
 	  NULL },
-	{ "max-records-per-type", &cfg_type_uint32,
+	{ CFG_CLAUSE_MAX_RECORDS_PER_TYPE, &cfg_type_uint32,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
 		  CFG_ZONE_STUB | CFG_ZONE_STATICSTUB | CFG_ZONE_REDIRECT,
 	  NULL },
-	{ "max-types-per-name", &cfg_type_uint32,
+	{ CFG_CLAUSE_MAX_TYPES_PER_NAME, &cfg_type_uint32,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
 		  CFG_ZONE_STUB | CFG_ZONE_STATICSTUB | CFG_ZONE_REDIRECT,
 	  NULL },
-	{ "max-refresh-time", &cfg_type_uint32,
+	{ CFG_CLAUSE_MAX_REFRESH_TIME, &cfg_type_uint32,
 	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB, NULL },
-	{ "max-retry-time", &cfg_type_uint32,
+	{ CFG_CLAUSE_MAX_RETRY_TIME, &cfg_type_uint32,
 	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB, NULL },
-	{ "min-transfer-rate-in", &cfg_type_min_transfer_rate_in,
+	{ CFG_CLAUSE_MIN_TRANSFER_RATE_IN, &cfg_type_min_transfer_rate_in,
 	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB, NULL },
-	{ "max-transfer-idle-in", &cfg_type_uint32,
+	{ CFG_CLAUSE_MAX_TRANSFER_IDLE_IN, &cfg_type_uint32,
 	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB, NULL },
-	{ "max-transfer-idle-out", &cfg_type_uint32,
+	{ CFG_CLAUSE_MAX_TRANSFER_IDLE_OUT, &cfg_type_uint32,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_MIRROR | CFG_ZONE_SECONDARY, NULL },
-	{ "max-transfer-time-in", &cfg_type_uint32,
+	{ CFG_CLAUSE_MAX_TRANSFER_TIME_IN, &cfg_type_uint32,
 	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB, NULL },
-	{ "max-transfer-time-out", &cfg_type_uint32,
+	{ CFG_CLAUSE_MAX_TRANSFER_TIME_OUT, &cfg_type_uint32,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_MIRROR | CFG_ZONE_SECONDARY, NULL },
-	{ "max-zone-ttl", &cfg_type_maxduration,
+	{ CFG_CLAUSE_MAX_ZONE_TTL, &cfg_type_maxduration,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_REDIRECT | CFG_CLAUSEFLAG_DEPRECATED,
 	  NULL },
-	{ "min-refresh-time", &cfg_type_uint32,
+	{ CFG_CLAUSE_MIN_REFRESH_TIME, &cfg_type_uint32,
 	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB, NULL },
-	{ "min-retry-time", &cfg_type_uint32,
+	{ CFG_CLAUSE_MIN_RETRY_TIME, &cfg_type_uint32,
 	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB, NULL },
-	{ "multi-master", &cfg_type_boolean,
+	{ CFG_CLAUSE_MULTI_MASTER, &cfg_type_boolean,
 	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB, NULL },
-	{ "notify", &cfg_type_notifytype,
+	{ CFG_CLAUSE_NOTIFY, &cfg_type_notifytype,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR, NULL },
-	{ "notify-cfg", &cfg_type_notifycfg,
+	{ CFG_CLAUSE_NOTIFY_CFG, &cfg_type_notifycfg,
 	  CFG_CLAUSEFLAG_MULTI | CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY |
 		  CFG_ZONE_MIRROR,
 	  NULL },
-	{ "notify-defer", &cfg_type_uint32,
+	{ CFG_CLAUSE_NOTIFY_DEFER, &cfg_type_uint32,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR, NULL },
-	{ "notify-delay", &cfg_type_uint32,
+	{ CFG_CLAUSE_NOTIFY_DELAY, &cfg_type_uint32,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR, NULL },
-	{ "notify-source", &cfg_type_sockaddr4wild,
+	{ CFG_CLAUSE_NOTIFY_SOURCE, &cfg_type_sockaddr4wild,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR, NULL },
-	{ "notify-source-v6", &cfg_type_sockaddr6wild,
+	{ CFG_CLAUSE_NOTIFY_SOURCE_V6, &cfg_type_sockaddr6wild,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR, NULL },
-	{ "notify-to-soa", &cfg_type_boolean,
+	{ CFG_CLAUSE_NOTIFY_TO_SOA, &cfg_type_boolean,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY, NULL },
-	{ "nsec3-test-zone", &cfg_type_boolean,
+	{ CFG_CLAUSE_NSEC3_TEST_ZONE, &cfg_type_boolean,
 	  CFG_CLAUSEFLAG_TESTONLY | CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY,
 	  NULL },
-	{ "parental-source", &cfg_type_sockaddr4wild,
+	{ CFG_CLAUSE_PARENTAL_SOURCE, &cfg_type_sockaddr4wild,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY, NULL },
-	{ "parental-source-v6", &cfg_type_sockaddr6wild,
+	{ CFG_CLAUSE_PARENTAL_SOURCE_V6, &cfg_type_sockaddr6wild,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY, NULL },
-	{ "provide-zoneversion", &cfg_type_boolean,
+	{ CFG_CLAUSE_PROVIDE_ZONEVERSION, &cfg_type_boolean,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR, NULL },
-	{ "send-report-channel", &cfg_type_astring,
+	{ CFG_CLAUSE_SEND_REPORT_CHANNEL, &cfg_type_astring,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY, NULL },
-	{ "request-expire", &cfg_type_boolean,
+	{ CFG_CLAUSE_REQUEST_EXPIRE, &cfg_type_boolean,
 	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR, NULL },
-	{ "request-ixfr", &cfg_type_boolean,
+	{ CFG_CLAUSE_REQUEST_IXFR, &cfg_type_boolean,
 	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR, NULL },
-	{ "request-ixfr-max-diffs", &cfg_type_uint32,
+	{ CFG_CLAUSE_REQUEST_IXFR_MAX_DIFFS, &cfg_type_uint32,
 	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR, NULL },
-	{ "serial-update-method", &cfg_type_updatemethod, CFG_ZONE_PRIMARY,
+	{ CFG_CLAUSE_SERIAL_UPDATE_METHOD, &cfg_type_updatemethod, CFG_ZONE_PRIMARY,
 	  NULL },
-	{ "sig-signing-nodes", &cfg_type_uint32,
+	{ CFG_CLAUSE_SIG_SIGNING_NODES, &cfg_type_uint32,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY, NULL },
-	{ "sig-signing-signatures", &cfg_type_uint32,
+	{ CFG_CLAUSE_SIG_SIGNING_SIGNATURES, &cfg_type_uint32,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY, NULL },
-	{ "sig-signing-type", &cfg_type_uint32,
+	{ CFG_CLAUSE_SIG_SIGNING_TYPE, &cfg_type_uint32,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY, NULL },
-	{ "sig-validity-interval", &cfg_type_validityinterval,
+	{ CFG_CLAUSE_SIG_VALIDITY_INTERVAL, &cfg_type_validityinterval,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_CLAUSEFLAG_OBSOLETE,
 	  NULL },
-	{ "dnskey-sig-validity", &cfg_type_uint32,
+	{ CFG_CLAUSE_DNSKEY_SIG_VALIDITY, &cfg_type_uint32,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_CLAUSEFLAG_OBSOLETE,
 	  NULL },
-	{ "transfer-source", &cfg_type_sockaddr4wild,
+	{ CFG_CLAUSE_TRANSFER_SOURCE, &cfg_type_sockaddr4wild,
 	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB, NULL },
-	{ "transfer-source-v6", &cfg_type_sockaddr6wild,
+	{ CFG_CLAUSE_TRANSFER_SOURCE_V6, &cfg_type_sockaddr6wild,
 	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB, NULL },
-	{ "try-tcp-refresh", &cfg_type_boolean,
+	{ CFG_CLAUSE_TRY_TCP_REFRESH, &cfg_type_boolean,
 	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR, NULL },
-	{ "update-check-ksk", &cfg_type_boolean,
+	{ CFG_CLAUSE_UPDATE_CHECK_KSK, &cfg_type_boolean,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_CLAUSEFLAG_OBSOLETE,
 	  NULL },
-	{ "use-alt-transfer-source", NULL,
+	{ CFG_CLAUSE_USE_ALT_TRANSFER_SOURCE, NULL,
 	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB |
 		  CFG_CLAUSEFLAG_ANCIENT,
 	  NULL },
-	{ "zero-no-soa-ttl", &cfg_type_boolean,
+	{ CFG_CLAUSE_ZERO_NO_SOA_TTL, &cfg_type_boolean,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR, NULL },
-	{ "zone-statistics", &cfg_type_zonestat,
+	{ CFG_CLAUSE_ZONE_STATISTICS, &cfg_type_zonestat,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
 		  CFG_ZONE_STUB | CFG_ZONE_STATICSTUB | CFG_ZONE_REDIRECT,
 	  NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 
 /*%
@@ -2761,72 +2762,72 @@ static cfg_clausedef_t zone_only_clauses[] = {
 	 * Note that the format of the check-names option is different between
 	 * the zone options and the global/view options.  Ugh.
 	 */
-	{ "type", &cfg_type_zonetype,
+	{ CFG_CLAUSE_TYPE, &cfg_type_zonetype,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
 		  CFG_ZONE_STUB | CFG_ZONE_STATICSTUB | CFG_ZONE_HINT |
 		  CFG_ZONE_REDIRECT | CFG_ZONE_FORWARD,
 	  NULL },
-	{ "check-names", &cfg_type_checkmode,
+	{ CFG_CLAUSE_CHECK_NAMES, &cfg_type_checkmode,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
 		  CFG_ZONE_HINT | CFG_ZONE_STUB,
 	  NULL },
-	{ "checkds", &cfg_type_checkdstype,
+	{ CFG_CLAUSE_CHECKDS, &cfg_type_checkdstype,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY, NULL },
-	{ "database", &cfg_type_astring,
+	{ CFG_CLAUSE_DATABASE, &cfg_type_astring,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
 		  CFG_ZONE_STUB,
 	  NULL },
-	{ "delegation-only", NULL,
+	{ CFG_CLAUSE_DELEGATION_ONLY, NULL,
 	  CFG_ZONE_HINT | CFG_ZONE_STUB | CFG_ZONE_FORWARD |
 		  CFG_CLAUSEFLAG_ANCIENT,
 	  NULL },
-	{ "dlz", &cfg_type_astring,
+	{ CFG_CLAUSE_DLZ, &cfg_type_astring,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_REDIRECT, NULL },
-	{ "file", &cfg_type_qstring,
+	{ CFG_CLAUSE_FILE, &cfg_type_qstring,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
 		  CFG_ZONE_STUB | CFG_ZONE_HINT | CFG_ZONE_REDIRECT,
 	  NULL },
-	{ "initial-file", &cfg_type_qstring, CFG_ZONE_PRIMARY, NULL },
-	{ "inline-signing", &cfg_type_boolean,
+	{ CFG_CLAUSE_INITIAL_FILE, &cfg_type_qstring, CFG_ZONE_PRIMARY, NULL },
+	{ CFG_CLAUSE_INLINE_SIGNING, &cfg_type_boolean,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY, NULL },
-	{ "ixfr-base", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "ixfr-from-differences", &cfg_type_boolean,
+	{ CFG_CLAUSE_IXFR_BASE, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_IXFR_FROM_DIFFERENCES, &cfg_type_boolean,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR, NULL },
-	{ "ixfr-tmp-file", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "journal", &cfg_type_qstring,
+	{ CFG_CLAUSE_IXFR_TMP_FILE, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_JOURNAL, &cfg_type_qstring,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR, NULL },
-	{ "log-report-channel", &cfg_type_boolean,
+	{ CFG_CLAUSE_LOG_REPORT_CHANNEL, &cfg_type_boolean,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY, NULL },
-	{ "masters", &cfg_type_namesockaddrkeylist,
+	{ CFG_CLAUSE_MASTERS, &cfg_type_namesockaddrkeylist,
 	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB |
 		  CFG_ZONE_REDIRECT | CFG_CLAUSEFLAG_NODOC,
 	  NULL },
-	{ "parental-agents", &cfg_type_namesockaddrkeylist,
+	{ CFG_CLAUSE_PARENTAL_AGENTS, &cfg_type_namesockaddrkeylist,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY, NULL },
-	{ "plugin", &cfg_type_plugin,
+	{ CFG_CLAUSE_PLUGIN, &cfg_type_plugin,
 	  CFG_CLAUSEFLAG_MULTI | CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY |
 		  CFG_ZONE_REDIRECT | CFG_ZONE_MIRROR,
 	  NULL },
-	{ "primaries", &cfg_type_namesockaddrkeylist,
+	{ CFG_CLAUSE_PRIMARIES, &cfg_type_namesockaddrkeylist,
 	  CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR | CFG_ZONE_STUB |
 		  CFG_ZONE_REDIRECT,
 	  NULL },
-	{ "pubkey", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "server-addresses", &cfg_type_bracketed_netaddrlist,
+	{ CFG_CLAUSE_PUBKEY, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_SERVER_ADDRESSES, &cfg_type_bracketed_netaddrlist,
 	  CFG_ZONE_STATICSTUB, NULL },
-	{ "server-names", &cfg_type_namelist, CFG_ZONE_STATICSTUB, NULL },
-	{ "update-policy", &cfg_type_updatepolicy, CFG_ZONE_PRIMARY, NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE_SERVER_NAMES, &cfg_type_namelist, CFG_ZONE_STATICSTUB, NULL },
+	{ CFG_CLAUSE_UPDATE_POLICY, &cfg_type_updatepolicy, CFG_ZONE_PRIMARY, NULL },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 
 static cfg_clausedef_t non_template_clauses[] = {
-	{ "in-view", &cfg_type_astring, CFG_ZONE_INVIEW, NULL },
-	{ "template", &cfg_type_astring,
+	{ CFG_CLAUSE_IN_VIEW, &cfg_type_astring, CFG_ZONE_INVIEW, NULL },
+	{ CFG_CLAUSE_TEMPLATE, &cfg_type_astring,
 	  CFG_ZONE_PRIMARY | CFG_ZONE_SECONDARY | CFG_ZONE_MIRROR |
 		  CFG_ZONE_STUB | CFG_ZONE_STATICSTUB | CFG_ZONE_HINT |
 		  CFG_ZONE_REDIRECT | CFG_ZONE_FORWARD,
 	  NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 
 /*% The top-level named.conf syntax. */
@@ -2894,9 +2895,9 @@ cfg_type_t cfg_type_dnssecpolicyopts = {
 /*% The "dynamically loadable zones" statement syntax. */
 
 static cfg_clausedef_t dlz_clauses[] = {
-	{ "database", &cfg_type_astring, 0, NULL },
-	{ "search", &cfg_type_boolean, 0, NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE_DATABASE, &cfg_type_astring, 0, NULL },
+	{ CFG_CLAUSE_SEARCH, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 static cfg_clausedef_t *dlz_clausesets[] = { dlz_clauses, NULL };
 static cfg_type_t cfg_type_dlz = { "dlz",	  cfg_parse_named_map,
@@ -2941,9 +2942,9 @@ static cfg_type_t cfg_type_plugin = { "plugin",	       cfg_parse_tuple,
  * Clauses that can be found within the 'key' statement.
  */
 static cfg_clausedef_t key_clauses[] = {
-	{ "algorithm", &cfg_type_astring, 0, NULL },
-	{ "secret", &cfg_type_sstring, 0, NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE_ALGORITHM, &cfg_type_astring, 0, NULL },
+	{ CFG_CLAUSE_SECRET, &cfg_type_sstring, 0, NULL },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 
 static cfg_clausedef_t *key_clausesets[] = { key_clauses, NULL };
@@ -2955,9 +2956,9 @@ static cfg_type_t cfg_type_key = { "key",	  cfg_parse_named_map,
  * A key-store statement.
  */
 static cfg_clausedef_t keystore_clauses[] = {
-	{ "directory", &cfg_type_astring, 0, NULL },
-	{ "pkcs11-uri", &cfg_type_qstring, 0, NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE_DIRECTORY, &cfg_type_astring, 0, NULL },
+	{ CFG_CLAUSE_PKCS11_URI, &cfg_type_qstring, 0, NULL },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 
 static cfg_clausedef_t *keystore_clausesets[] = { keystore_clauses, NULL };
@@ -2983,34 +2984,34 @@ static cfg_type_t cfg_type_keystore = { "key-store",	 cfg_parse_tuple,
  * exercise the new clause when adding new clauses.
  */
 static cfg_clausedef_t server_clauses[] = {
-	{ "bogus", &cfg_type_boolean, 0, NULL },
-	{ "edns", &cfg_type_boolean, 0, NULL },
-	{ "edns-udp-size", &cfg_type_uint32, 0, NULL },
-	{ "edns-version", &cfg_type_uint32, 0, NULL },
-	{ "keys", &cfg_type_server_key_kludge, 0, NULL },
-	{ "max-udp-size", &cfg_type_uint32, 0, NULL },
-	{ "notify-source", &cfg_type_sockaddr4wild, 0, NULL },
-	{ "notify-source-v6", &cfg_type_sockaddr6wild, 0, NULL },
-	{ "padding", &cfg_type_uint32, 0, NULL },
-	{ "provide-ixfr", &cfg_type_boolean, 0, NULL },
-	{ "query-source", &cfg_type_server_querysource4, 0, NULL },
-	{ "query-source-v6", &cfg_type_server_querysource6, 0, NULL },
-	{ "request-expire", &cfg_type_boolean, 0, NULL },
-	{ "request-ixfr", &cfg_type_boolean, 0, NULL },
-	{ "request-ixfr-max-diffs", &cfg_type_uint32, 0, NULL },
-	{ "request-nsid", &cfg_type_boolean, 0, NULL },
-	{ "request-zoneversion", &cfg_type_boolean, 0, NULL },
-	{ "request-sit", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "require-cookie", &cfg_type_boolean, 0, NULL },
-	{ "send-cookie", &cfg_type_boolean, 0, NULL },
-	{ "support-ixfr", NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
-	{ "tcp-keepalive", &cfg_type_boolean, 0, NULL },
-	{ "tcp-only", &cfg_type_boolean, 0, NULL },
-	{ "transfer-format", &cfg_type_transferformat, 0, NULL },
-	{ "transfer-source", &cfg_type_sockaddr4wild, 0, NULL },
-	{ "transfer-source-v6", &cfg_type_sockaddr6wild, 0, NULL },
-	{ "transfers", &cfg_type_uint32, 0, NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE_BOGUS, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_EDNS, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_EDNS_UDP_SIZE, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_EDNS_VERSION, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_KEYS, &cfg_type_server_key_kludge, 0, NULL },
+	{ CFG_CLAUSE_MAX_UDP_SIZE, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_NOTIFY_SOURCE, &cfg_type_sockaddr4wild, 0, NULL },
+	{ CFG_CLAUSE_NOTIFY_SOURCE_V6, &cfg_type_sockaddr6wild, 0, NULL },
+	{ CFG_CLAUSE_PADDING, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_PROVIDE_IXFR, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_QUERY_SOURCE, &cfg_type_server_querysource4, 0, NULL },
+	{ CFG_CLAUSE_QUERY_SOURCE_V6, &cfg_type_server_querysource6, 0, NULL },
+	{ CFG_CLAUSE_REQUEST_EXPIRE, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_REQUEST_IXFR, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_REQUEST_IXFR_MAX_DIFFS, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_REQUEST_NSID, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_REQUEST_ZONEVERSION, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_REQUEST_SIT, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_REQUIRE_COOKIE, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_SEND_COOKIE, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_SUPPORT_IXFR, NULL, CFG_CLAUSEFLAG_ANCIENT, NULL },
+	{ CFG_CLAUSE_TCP_KEEPALIVE, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_TCP_ONLY, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_TRANSFER_FORMAT, &cfg_type_transferformat, 0, NULL },
+	{ CFG_CLAUSE_TRANSFER_SOURCE, &cfg_type_sockaddr4wild, 0, NULL },
+	{ CFG_CLAUSE_TRANSFER_SOURCE_V6, &cfg_type_sockaddr6wild, 0, NULL },
+	{ CFG_CLAUSE_TRANSFERS, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 static cfg_clausedef_t *server_clausesets[] = { server_clauses, NULL };
 static cfg_type_t cfg_type_server = { "server",	     cfg_parse_netprefix_map,
@@ -3042,17 +3043,17 @@ static cfg_type_t cfg_type_printtime = { "printtime",	    parse_printtime,
 
 static cfg_clausedef_t channel_clauses[] = {
 	/* Destinations.  We no longer require these to be first. */
-	{ "file", &cfg_type_logfile, 0, NULL },
-	{ "syslog", &cfg_type_optional_facility, 0, NULL },
-	{ "null", &cfg_type_void, 0, NULL },
-	{ "stderr", &cfg_type_void, 0, NULL },
+	{ CFG_CLAUSE_FILE, &cfg_type_logfile, 0, NULL },
+	{ CFG_CLAUSE_SYSLOG, &cfg_type_optional_facility, 0, NULL },
+	{ CFG_CLAUSE_NULL, &cfg_type_void, 0, NULL },
+	{ CFG_CLAUSE_STDERR, &cfg_type_void, 0, NULL },
 	/* Options.  We now accept these for the null channel, too. */
-	{ "severity", &cfg_type_logseverity, 0, NULL },
-	{ "print-time", &cfg_type_printtime, 0, NULL },
-	{ "print-severity", &cfg_type_boolean, 0, NULL },
-	{ "print-category", &cfg_type_boolean, 0, NULL },
-	{ "buffered", &cfg_type_boolean, 0, NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE_SEVERITY, &cfg_type_logseverity, 0, NULL },
+	{ CFG_CLAUSE_PRINT_TIME, &cfg_type_printtime, 0, NULL },
+	{ CFG_CLAUSE_PRINT_SEVERITY, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_PRINT_CATEGORY, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_BUFFERED, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 static cfg_clausedef_t *channel_clausesets[] = { channel_clauses, NULL };
 static cfg_type_t cfg_type_channel = { "channel",     cfg_parse_named_map,
@@ -3071,9 +3072,9 @@ static cfg_type_t cfg_type_destinationlist = { "destinationlist",
  * Clauses that can be found in a 'logging' statement.
  */
 static cfg_clausedef_t logging_clauses[] = {
-	{ "channel", &cfg_type_channel, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "category", &cfg_type_category, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE_CHANNEL, &cfg_type_channel, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_CATEGORY, &cfg_type_category, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 static cfg_clausedef_t *logging_clausesets[] = { logging_clauses, NULL };
 static cfg_type_t cfg_type_logging = { "logging",     cfg_parse_map,
@@ -3094,9 +3095,9 @@ static cfg_type_t cfg_type_addzone = { "zone",		cfg_parse_tuple,
 				       cfg_print_tuple, cfg_doc_tuple,
 				       &cfg_rep_tuple,	addzone_fields };
 
-static cfg_clausedef_t addzoneconf_clauses[] = { { "zone", &cfg_type_addzone,
+static cfg_clausedef_t addzoneconf_clauses[] = { { CFG_CLAUSE_ZONE, &cfg_type_addzone,
 						   CFG_CLAUSEFLAG_MULTI, NULL },
-						 { NULL, NULL, 0, NULL } };
+						 { CFG_CLAUSE__NONE, NULL, 0, NULL } };
 
 static cfg_clausedef_t *addzoneconf_clausesets[] = { addzoneconf_clauses,
 						     NULL };
@@ -3403,13 +3404,13 @@ static cfg_type_t cfg_type_notifytype = {
  * Generalized DNS Notifications.
  */
 static cfg_clausedef_t notify_clauses[] = {
-	{ "notify", &cfg_type_boolean, 0, NULL }, /* this limits the options for
+	{ CFG_CLAUSE_NOTIFY, &cfg_type_boolean, 0, NULL }, /* this limits the options for
 						     NOTIFY(SOA) */
-	{ "notify-defer", &cfg_type_uint32, 0, NULL },
-	{ "notify-delay", &cfg_type_uint32, 0, NULL },
-	{ "notify-source", &cfg_type_sockaddr4wild, 0, NULL },
-	{ "notify-source-v6", &cfg_type_sockaddr6wild, 0, NULL },
-	{ NULL, NULL, 0, NULL },
+	{ CFG_CLAUSE_NOTIFY_DEFER, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_NOTIFY_DELAY, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_NOTIFY_SOURCE, &cfg_type_sockaddr4wild, 0, NULL },
+	{ CFG_CLAUSE_NOTIFY_SOURCE_V6, &cfg_type_sockaddr6wild, 0, NULL },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL },
 };
 
 static cfg_clausedef_t *notify_clausesets[] = { notify_clauses, NULL };
@@ -3541,9 +3542,9 @@ static cfg_type_t cfg_type_unixcontrol = {
 };
 
 static cfg_clausedef_t controls_clauses[] = {
-	{ "inet", &cfg_type_inetcontrol, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "unix", &cfg_type_unixcontrol, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE_INET, &cfg_type_inetcontrol, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_UNIX, &cfg_type_unixcontrol, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 
 static cfg_clausedef_t *controls_clausesets[] = { controls_clauses, NULL };
@@ -3583,8 +3584,8 @@ static cfg_type_t cfg_type_statschannel = {
 };
 
 static cfg_clausedef_t statservers_clauses[] = {
-	{ "inet", &cfg_type_statschannel, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE_INET, &cfg_type_statschannel, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 
 static cfg_clausedef_t *statservers_clausesets[] = { statservers_clauses,
@@ -4020,12 +4021,12 @@ static cfg_type_t cfg_type_optional_sourceaddr6 = {
  */
 
 static cfg_clausedef_t rndcconf_options_clauses[] = {
-	{ "default-key", &cfg_type_astring, 0, NULL },
-	{ "default-port", &cfg_type_uint32, 0, NULL },
-	{ "default-server", &cfg_type_astring, 0, NULL },
-	{ "default-source-address", &cfg_type_netaddr4wild, 0, NULL },
-	{ "default-source-address-v6", &cfg_type_netaddr6wild, 0, NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE_DEFAULT_KEY, &cfg_type_astring, 0, NULL },
+	{ CFG_CLAUSE_DEFAULT_PORT, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_DEFAULT_SERVER, &cfg_type_astring, 0, NULL },
+	{ CFG_CLAUSE_DEFAULT_SOURCE_ADDRESS, &cfg_type_netaddr4wild, 0, NULL },
+	{ CFG_CLAUSE_DEFAULT_SOURCE_ADDRESS_V6, &cfg_type_netaddr6wild, 0, NULL },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 
 static cfg_clausedef_t *rndcconf_options_clausesets[] = {
@@ -4038,12 +4039,12 @@ static cfg_type_t cfg_type_rndcconf_options = {
 };
 
 static cfg_clausedef_t rndcconf_server_clauses[] = {
-	{ "key", &cfg_type_astring, 0, NULL },
-	{ "port", &cfg_type_uint32, 0, NULL },
-	{ "source-address", &cfg_type_netaddr4wild, 0, NULL },
-	{ "source-address-v6", &cfg_type_netaddr6wild, 0, NULL },
-	{ "addresses", &cfg_type_bracketed_sockaddrnameportlist, 0, NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE_KEY, &cfg_type_astring, 0, NULL },
+	{ CFG_CLAUSE_PORT, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_SOURCE_ADDRESS, &cfg_type_netaddr4wild, 0, NULL },
+	{ CFG_CLAUSE_SOURCE_ADDRESS_V6, &cfg_type_netaddr6wild, 0, NULL },
+	{ CFG_CLAUSE_ADDRESSES, &cfg_type_bracketed_sockaddrnameportlist, 0, NULL },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 
 static cfg_clausedef_t *rndcconf_server_clausesets[] = {
@@ -4056,10 +4057,10 @@ static cfg_type_t cfg_type_rndcconf_server = {
 };
 
 static cfg_clausedef_t rndcconf_clauses[] = {
-	{ "key", &cfg_type_key, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "server", &cfg_type_rndcconf_server, CFG_CLAUSEFLAG_MULTI, NULL },
-	{ "options", &cfg_type_rndcconf_options, 0, NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE_KEY, &cfg_type_key, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_SERVER, &cfg_type_rndcconf_server, CFG_CLAUSEFLAG_MULTI, NULL },
+	{ CFG_CLAUSE_OPTIONS, &cfg_type_rndcconf_options, 0, NULL },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 
 static cfg_clausedef_t *rndcconf_clausesets[] = { rndcconf_clauses, NULL };
@@ -4068,8 +4069,8 @@ cfg_type_t cfg_type_rndcconf = { "rndcconf",	    cfg_parse_mapbody,
 				 cfg_print_mapbody, cfg_doc_mapbody,
 				 &cfg_rep_map,	    rndcconf_clausesets };
 
-static cfg_clausedef_t rndckey_clauses[] = { { "key", &cfg_type_key, 0, NULL },
-					     { NULL, NULL, 0, NULL } };
+static cfg_clausedef_t rndckey_clauses[] = { { CFG_CLAUSE_KEY, &cfg_type_key, 0, NULL },
+					     { CFG_CLAUSE__NONE, NULL, 0, NULL } };
 
 static cfg_clausedef_t *rndckey_clausesets[] = { rndckey_clauses, NULL };
 
@@ -4231,33 +4232,33 @@ static int
 cmp_clause(const void *ap, const void *bp) {
 	const cfg_clausedef_t *a = (const cfg_clausedef_t *)ap;
 	const cfg_clausedef_t *b = (const cfg_clausedef_t *)bp;
-	return strcmp(a->name, b->name);
+	return (a->name > b->name) - (a->name < b->name);
 }
 
 bool
-cfg_clause_validforzone(const char *name, unsigned int ztype) {
+cfg_clause_validforzone(enum cfg_clause name, unsigned int ztype) {
 	const cfg_clausedef_t *clause;
 	bool valid = false;
 
-	for (clause = zone_clauses; clause->name != NULL; clause++) {
+	for (clause = zone_clauses; clause->name != CFG_CLAUSE__NONE; clause++) {
 		if ((clause->flags & ztype) == 0 ||
-		    strcmp(clause->name, name) != 0)
+		    clause->name != name)
 		{
 			continue;
 		}
 		valid = true;
 	}
-	for (clause = zone_only_clauses; clause->name != NULL; clause++) {
+	for (clause = zone_only_clauses; clause->name != CFG_CLAUSE__NONE; clause++) {
 		if ((clause->flags & ztype) == 0 ||
-		    strcmp(clause->name, name) != 0)
+		    clause->name != name)
 		{
 			continue;
 		}
 		valid = true;
 	}
-	for (clause = non_template_clauses; clause->name != NULL; clause++) {
+	for (clause = non_template_clauses; clause->name != CFG_CLAUSE__NONE; clause++) {
 		if ((clause->flags & ztype) == 0 ||
-		    strcmp(clause->name, name) != 0)
+		    clause->name != name)
 		{
 			continue;
 		}
@@ -4377,17 +4378,17 @@ static cfg_type_t cfg_type_tlsprotos = { "tls_protocols",
 					 &cfg_type_astring };
 
 static cfg_clausedef_t tls_clauses[] = {
-	{ "key-file", &cfg_type_qstring, 0, NULL },
-	{ "cert-file", &cfg_type_qstring, 0, NULL },
-	{ "ca-file", &cfg_type_qstring, 0, NULL },
-	{ "remote-hostname", &cfg_type_qstring, 0, NULL },
-	{ "dhparam-file", &cfg_type_qstring, 0, NULL },
-	{ "protocols", &cfg_type_tlsprotos, 0, NULL },
-	{ "ciphers", &cfg_type_astring, 0, NULL },
-	{ "cipher-suites", &cfg_type_astring, 0, NULL },
-	{ "prefer-server-ciphers", &cfg_type_boolean, 0, NULL },
-	{ "session-tickets", &cfg_type_boolean, 0, NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE_KEY_FILE, &cfg_type_qstring, 0, NULL },
+	{ CFG_CLAUSE_CERT_FILE, &cfg_type_qstring, 0, NULL },
+	{ CFG_CLAUSE_CA_FILE, &cfg_type_qstring, 0, NULL },
+	{ CFG_CLAUSE_REMOTE_HOSTNAME, &cfg_type_qstring, 0, NULL },
+	{ CFG_CLAUSE_DHPARAM_FILE, &cfg_type_qstring, 0, NULL },
+	{ CFG_CLAUSE_PROTOCOLS, &cfg_type_tlsprotos, 0, NULL },
+	{ CFG_CLAUSE_CIPHERS, &cfg_type_astring, 0, NULL },
+	{ CFG_CLAUSE_CIPHER_SUITES, &cfg_type_astring, 0, NULL },
+	{ CFG_CLAUSE_PREFER_SERVER_CIPHERS, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE_SESSION_TICKETS, &cfg_type_boolean, 0, NULL },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 
 static cfg_clausedef_t *tls_clausesets[] = { tls_clauses, NULL };
@@ -4413,10 +4414,10 @@ static cfg_type_t cfg_type_bracketed_http_endpoint_list = {
 };
 
 static cfg_clausedef_t cfg_http_description_clauses[] = {
-	{ "endpoints", &cfg_type_bracketed_http_endpoint_list, 0, NULL },
-	{ "listener-clients", &cfg_type_uint32, 0, NULL },
-	{ "streams-per-connection", &cfg_type_uint32, 0, NULL },
-	{ NULL, NULL, 0, NULL }
+	{ CFG_CLAUSE_ENDPOINTS, &cfg_type_bracketed_http_endpoint_list, 0, NULL },
+	{ CFG_CLAUSE_LISTENER_CLIENTS, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE_STREAMS_PER_CONNECTION, &cfg_type_uint32, 0, NULL },
+	{ CFG_CLAUSE__NONE, NULL, 0, NULL }
 };
 
 static cfg_clausedef_t *http_description_clausesets[] = {
diff --git a/lib/isccfg/parser.c b/lib/isccfg/parser.c
index 524ee1f319f..39cba5a7089 100644
--- a/lib/isccfg/parser.c
+++ b/lib/isccfg/parser.c
@@ -66,6 +66,7 @@
 #include <dns/ttl.h>
 
 #include <isccfg/cfg.h>
+#include <isccfg/clause.h>
 #include <isccfg/grammar.h>
 
 /*
@@ -2450,18 +2451,20 @@ cfg_parse_mapbody(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 
 		clause = NULL;
 		for (clauseset = clausesets; *clauseset != NULL; clauseset++) {
-			for (clause = *clauseset; clause->name != NULL;
-			     clause++)
+			for (clause = *clauseset;
+			     clause->name != CFG_CLAUSE__NONE; clause++)
 			{
-				if (strcasecmp(TOKEN_STRING(pctx),
-					       clause->name) == 0)
+				if (strcasecmp(
+					    TOKEN_STRING(pctx),
+					    cfg_clause_as_string[clause->name]) ==
+				    0)
 				{
 					goto done;
 				}
 			}
 		}
 	done:
-		if (clause == NULL || clause->name == NULL) {
+		if (clause == NULL || clause->name == CFG_CLAUSE__NONE) {
 			cfg_parser_error(pctx, CFG_LOG_NOPREP,
 					 "unknown option");
 			/*
@@ -2481,7 +2484,7 @@ cfg_parse_mapbody(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 		if ((clause->flags & CFG_CLAUSEFLAG_ANCIENT) != 0) {
 			cfg_parser_error(pctx, 0,
 					 "option '%s' no longer exists",
-					 clause->name);
+					 cfg_clause_as_string[clause->name]);
 			CLEANUP(ISC_R_FAILURE);
 		}
 		if ((pctx->flags & CFG_PCTX_ALLCONFIGS) == 0 &&
@@ -2490,7 +2493,7 @@ cfg_parse_mapbody(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 			cfg_parser_error(pctx, 0,
 					 "option '%s' was not "
 					 "enabled at compile time",
-					 clause->name);
+					 cfg_clause_as_string[clause->name]);
 			CLEANUP(ISC_R_FAILURE);
 		}
 		if ((pctx->flags & CFG_PCTX_BUILTIN) == 0 &&
@@ -2499,7 +2502,7 @@ cfg_parse_mapbody(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 			cfg_parser_error(pctx, 0,
 					 "option '%s' is allowed in the "
 					 "builtin configuration only",
-					 clause->name);
+					 cfg_clause_as_string[clause->name]);
 			CHECK(ISC_R_FAILURE);
 		}
 
@@ -2508,7 +2511,7 @@ cfg_parse_mapbody(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 		    (clause->flags & CFG_CLAUSEFLAG_DEPRECATED) != 0)
 		{
 			cfg_parser_warning(pctx, 0, "option '%s' is deprecated",
-					   clause->name);
+					   cfg_clause_as_string[clause->name]);
 		}
 		if ((pctx->flags & CFG_PCTX_NOOBSOLETE) == 0 &&
 		    (clause->flags & CFG_CLAUSEFLAG_OBSOLETE) != 0)
@@ -2516,7 +2519,7 @@ cfg_parse_mapbody(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 			cfg_parser_warning(pctx, 0,
 					   "option '%s' is obsolete and "
 					   "should be removed ",
-					   clause->name);
+					   cfg_clause_as_string[clause->name]);
 		}
 		if ((pctx->flags & CFG_PCTX_NOEXPERIMENTAL) == 0 &&
 		    (clause->flags & CFG_CLAUSEFLAG_EXPERIMENTAL) != 0)
@@ -2524,7 +2527,7 @@ cfg_parse_mapbody(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 			cfg_parser_warning(pctx, 0,
 					   "option '%s' is experimental and "
 					   "subject to change in the future",
-					   clause->name);
+					   cfg_clause_as_string[clause->name]);
 		}
 
 		/* See if the clause already has a value; if not create one. */
@@ -2537,8 +2540,8 @@ cfg_parse_mapbody(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 				    &cfg_type_implicitlist, &listobj);
 			symval.as_pointer = listobj;
 			result = isc_symtab_define_and_return(
-				obj->value.map->symtab, clause->name,
-				SYMTAB_DUMMY_TYPE, symval, isc_symexists_reject,
+				obj->value.map->symtab, "",
+				clause->name, symval, isc_symexists_reject,
 				&symval);
 			if (result == ISC_R_EXISTS) {
 				CLEANUP_OBJ(listobj);
@@ -2554,9 +2557,9 @@ cfg_parse_mapbody(cfg_parser_t *pctx, const cfg_type_t *type, cfg_obj_t **ret) {
 			result = parse_symtab_elt(pctx, clause,
 						  obj->value.map->symtab);
 			if (result == ISC_R_EXISTS) {
-				cfg_parser_error(pctx, CFG_LOG_NEAR,
-						 "'%s' redefined",
-						 clause->name);
+				cfg_parser_error(
+					pctx, CFG_LOG_NEAR, "'%s' redefined",
+					cfg_clause_as_string[clause->name]);
 				CHECK(result);
 			} else if (result != ISC_R_SUCCESS) {
 				cfg_parser_error(pctx, CFG_LOG_NEAR,
@@ -2623,7 +2626,7 @@ parse_symtab_elt(cfg_parser_t *pctx, const cfg_clausedef_t *clause,
 	}
 
 	symval.as_pointer = obj;
-	CHECK(isc_symtab_define(symtab, clause->name, SYMTAB_DUMMY_TYPE, symval,
+	CHECK(isc_symtab_define(symtab, "", clause->name, symval,
 				isc_symexists_reject));
 	return ISC_R_SUCCESS;
 
@@ -2736,29 +2739,31 @@ cfg_print_mapbody(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 		isc_symvalue_t symval;
 		const cfg_clausedef_t *clause;
 
-		for (clause = *clauseset; clause->name != NULL; clause++) {
+		for (clause = *clauseset; clause->name != CFG_CLAUSE__NONE;
+		     clause++)
+		{
 			isc_result_t result;
 
 			if ((clause->flags & CFG_CLAUSEFLAG_BUILTINONLY) != 0) {
 				continue;
 			}
 
-			result = isc_symtab_lookup(obj->value.map->symtab,
-						   clause->name,
-						   SYMTAB_DUMMY_TYPE, &symval);
+			result = isc_symtab_lookup(obj->value.map->symtab, "",
+						   clause->name, &symval);
 			if (result == ISC_R_SUCCESS) {
 				cfg_obj_t *symobj = symval.as_pointer;
+				const char *namestr =
+					cfg_clause_as_string[clause->name];
 				if (symobj->type == &cfg_type_implicitlist) {
 					/* Multivalued. */
 					cfg_list_t *list = symobj->value.list;
 					ISC_LIST_FOREACH(*list, elt, link) {
-						print_symval(pctx, clause->name,
+						print_symval(pctx, namestr,
 							     elt->obj);
 					}
 				} else {
 					/* Single-valued. */
-					print_symval(pctx, clause->name,
-						     symobj);
+					print_symval(pctx, namestr, symobj);
 				}
 			} else if (result == ISC_R_NOTFOUND) {
 				/* do nothing */
@@ -2810,7 +2815,9 @@ cfg_doc_mapbody(cfg_printer_t *pctx, const cfg_type_t *type) {
 	REQUIRE(type != NULL);
 
 	for (clauseset = type->of; *clauseset != NULL; clauseset++) {
-		for (clause = *clauseset; clause->name != NULL; clause++) {
+		for (clause = *clauseset; clause->name != CFG_CLAUSE__NONE;
+		     clause++)
+		{
 			if (((pctx->flags & CFG_PRINTER_ACTIVEONLY) != 0) &&
 			    (((clause->flags & CFG_CLAUSEFLAG_OBSOLETE) != 0) ||
 			     ((clause->flags & CFG_CLAUSEFLAG_TESTONLY) != 0)))
@@ -2822,7 +2829,8 @@ cfg_doc_mapbody(cfg_printer_t *pctx, const cfg_type_t *type) {
 			{
 				continue;
 			}
-			cfg_print_cstr(pctx, clause->name);
+			cfg_print_cstr(pctx,
+				       cfg_clause_as_string[clause->name]);
 			cfg_print_cstr(pctx, " ");
 			cfg_doc_obj(pctx, clause->type);
 			cfg_print_cstr(pctx, ";");
@@ -2868,7 +2876,9 @@ cfg_doc_map(cfg_printer_t *pctx, const cfg_type_t *type) {
 	print_open(pctx);
 
 	for (clauseset = type->of; *clauseset != NULL; clauseset++) {
-		for (clause = *clauseset; clause->name != NULL; clause++) {
+		for (clause = *clauseset; clause->name != CFG_CLAUSE__NONE;
+		     clause++)
+		{
 			if (((pctx->flags & CFG_PRINTER_ACTIVEONLY) != 0) &&
 			    (((clause->flags & CFG_CLAUSEFLAG_OBSOLETE) != 0) ||
 			     ((clause->flags & CFG_CLAUSEFLAG_TESTONLY) != 0)))
@@ -2881,7 +2891,8 @@ cfg_doc_map(cfg_printer_t *pctx, const cfg_type_t *type) {
 				continue;
 			}
 			cfg_print_indent(pctx);
-			cfg_print_cstr(pctx, clause->name);
+			cfg_print_cstr(pctx,
+				       cfg_clause_as_string[clause->name]);
 			if (clause->type->print != cfg_print_void) {
 				cfg_print_cstr(pctx, " ");
 			}
@@ -2901,17 +2912,18 @@ cfg_obj_ismap(const cfg_obj_t *obj) {
 }
 
 isc_result_t
-cfg_map_get(const cfg_obj_t *mapobj, const char *name, const cfg_obj_t **obj) {
+cfg_map_get(const cfg_obj_t *mapobj, enum cfg_clause name,
+	    const cfg_obj_t **obj) {
 	isc_symvalue_t val;
 	const cfg_map_t *map;
 
 	REQUIRE(mapobj != NULL && mapobj->type->rep == &cfg_rep_map);
-	REQUIRE(name != NULL);
+	REQUIRE(name != CFG_CLAUSE__NONE);
 	REQUIRE(obj != NULL && *obj == NULL);
 
 	map = mapobj->value.map;
 
-	RETERR(isc_symtab_lookup(map->symtab, name, SYMTAB_DUMMY_TYPE, &val));
+	RETERR(isc_symtab_lookup(map->symtab, "", name, &val));
 	*obj = val.as_pointer;
 	return ISC_R_SUCCESS;
 }
@@ -2949,7 +2961,7 @@ cfg_map_firstclause(const cfg_type_t *map, const void **clauses,
 	}
 	*clauses = *clauseset;
 	*idx = 0;
-	while ((*clauseset)[*idx].name == NULL) {
+	while ((*clauseset)[*idx].name == CFG_CLAUSE__NONE) {
 		*clauses = (*++clauseset);
 		if (*clauses == NULL) {
 			return NULL;
@@ -2973,7 +2985,7 @@ cfg_map_nextclause(const cfg_type_t *map, const void **clauses,
 	}
 	INSIST(*clauseset == *clauses);
 	(*idx)++;
-	while ((*clauseset)[*idx].name == NULL) {
+	while ((*clauseset)[*idx].name == CFG_CLAUSE__NONE) {
 		*idx = 0;
 		*clauses = (*++clauseset);
 		if (*clauses == NULL) {
@@ -2984,16 +2996,16 @@ cfg_map_nextclause(const cfg_type_t *map, const void **clauses,
 }
 
 const cfg_clausedef_t *
-cfg_map_findclause(const cfg_type_t *map, const char *name) {
+cfg_map_findclause(const cfg_type_t *map, enum cfg_clause name) {
 	const cfg_clausedef_t *found = NULL;
 	const void *clauses = NULL;
 	unsigned int idx;
 
 	REQUIRE(map != NULL && map->rep == &cfg_rep_map);
-	REQUIRE(name != NULL);
+	REQUIRE(name != CFG_CLAUSE__NONE);
 
 	found = cfg_map_firstclause(map, &clauses, &idx);
-	while (name != NULL && strcasecmp(name, found->name)) {
+	while (found != NULL && found->name != name) {
 		found = cfg_map_nextclause(map, &clauses, &idx);
 	}
 
@@ -3005,13 +3017,33 @@ cfg_map_findclause(const cfg_type_t *map, const char *name) {
  * obj->value.map_external and check &cfg_rep_map_external.
  */
 
+static isc_result_t
+parse_symtab_elt_external(cfg_parser_t *pctx,
+			  const cfg_clausedef_external_t *clause,
+			  isc_symtab_t *symtab) {
+	isc_result_t result;
+	cfg_obj_t *obj = NULL;
+	isc_symvalue_t symval;
+
+	CHECK(cfg_parse_obj(pctx, clause->type, &obj));
+
+	symval.as_pointer = obj;
+	CHECK(isc_symtab_define(symtab, clause->name, SYMTAB_DUMMY_TYPE, symval,
+				isc_symexists_reject));
+	return ISC_R_SUCCESS;
+
+cleanup:
+	CLEANUP_OBJ(obj);
+	return result;
+}
+
 isc_result_t
 cfg_parse_mapbody_external(cfg_parser_t *pctx, const cfg_type_t *type,
 			   cfg_obj_t **ret) {
-	const cfg_clausedef_t *const *clausesets;
+	const cfg_clausedef_external_t *const *clausesets;
 	isc_result_t result;
-	const cfg_clausedef_t *const *clauseset;
-	const cfg_clausedef_t *clause;
+	const cfg_clausedef_external_t *const *clauseset;
+	const cfg_clausedef_external_t *clause;
 	cfg_obj_t *value = NULL;
 	cfg_obj_t *obj = NULL;
 	cfg_obj_t *eltobj = NULL;
@@ -3169,7 +3201,7 @@ cfg_parse_mapbody_external(cfg_parser_t *pctx, const cfg_type_t *type,
 			ISC_LIST_APPEND(*listobj->value.list, elt, link);
 			CHECK(parse_semicolon(pctx));
 		} else {
-			result = parse_symtab_elt(
+			result = parse_symtab_elt_external(
 				pctx, clause,
 				obj->value.map_external->symtab);
 			if (result == ISC_R_EXISTS) {
@@ -3215,7 +3247,7 @@ cleanup:
 
 void
 cfg_print_mapbody_external(cfg_printer_t *pctx, const cfg_obj_t *obj) {
-	const cfg_clausedef_t *const *clauseset;
+	const cfg_clausedef_external_t *const *clauseset;
 
 	REQUIRE(pctx != NULL);
 	REQUIRE(VALID_CFGOBJ(obj));
@@ -3224,7 +3256,7 @@ cfg_print_mapbody_external(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 	     *clauseset != NULL; clauseset++)
 	{
 		isc_symvalue_t symval;
-		const cfg_clausedef_t *clause;
+		const cfg_clausedef_external_t *clause;
 
 		for (clause = *clauseset; clause->name != NULL; clause++) {
 			isc_result_t result;
@@ -3273,8 +3305,8 @@ cfg_print_map_external(cfg_printer_t *pctx, const cfg_obj_t *obj) {
 
 void
 cfg_doc_mapbody_external(cfg_printer_t *pctx, const cfg_type_t *type) {
-	const cfg_clausedef_t *const *clauseset;
-	const cfg_clausedef_t *clause;
+	const cfg_clausedef_external_t *const *clauseset;
+	const cfg_clausedef_external_t *clause;
 
 	REQUIRE(pctx != NULL);
 	REQUIRE(type != NULL);
@@ -3304,8 +3336,8 @@ cfg_doc_mapbody_external(cfg_printer_t *pctx, const cfg_type_t *type) {
 
 void
 cfg_doc_map_external(cfg_printer_t *pctx, const cfg_type_t *type) {
-	const cfg_clausedef_t *const *clauseset;
-	const cfg_clausedef_t *clause;
+	const cfg_clausedef_external_t *const *clauseset;
+	const cfg_clausedef_external_t *clause;
 
 	REQUIRE(pctx != NULL);
 	REQUIRE(type != NULL);
@@ -3391,10 +3423,10 @@ cfg_map_external_count(const cfg_obj_t *mapobj) {
 	return isc_symtab_count(map->symtab);
 }
 
-const cfg_clausedef_t *
+const cfg_clausedef_external_t *
 cfg_map_external_firstclause(const cfg_type_t *map, const void **clauses,
 			     unsigned int *idx) {
-	cfg_clausedef_t *const *clauseset;
+	cfg_clausedef_external_t *const *clauseset;
 
 	REQUIRE(map != NULL && map->rep == &cfg_rep_map_external);
 	REQUIRE(idx != NULL);
@@ -3415,10 +3447,10 @@ cfg_map_external_firstclause(const cfg_type_t *map, const void **clauses,
 	return &(*clauseset)[*idx];
 }
 
-const cfg_clausedef_t *
+const cfg_clausedef_external_t *
 cfg_map_external_nextclause(const cfg_type_t *map, const void **clauses,
 			    unsigned int *idx) {
-	cfg_clausedef_t *const *clauseset;
+	cfg_clausedef_external_t *const *clauseset;
 
 	REQUIRE(map != NULL && map->rep == &cfg_rep_map_external);
 	REQUIRE(idx != NULL);
@@ -3440,9 +3472,9 @@ cfg_map_external_nextclause(const cfg_type_t *map, const void **clauses,
 	return &(*clauseset)[*idx];
 }
 
-const cfg_clausedef_t *
+const cfg_clausedef_external_t *
 cfg_map_external_findclause(const cfg_type_t *map, const char *name) {
-	const cfg_clausedef_t *found = NULL;
+	const cfg_clausedef_external_t *found = NULL;
 	const void *clauses = NULL;
 	unsigned int idx;
 
@@ -3450,11 +3482,11 @@ cfg_map_external_findclause(const cfg_type_t *map, const char *name) {
 	REQUIRE(name != NULL);
 
 	found = cfg_map_external_firstclause(map, &clauses, &idx);
-	while (name != NULL && strcasecmp(name, found->name)) {
+	while (found != NULL && strcasecmp(name, found->name)) {
 		found = cfg_map_external_nextclause(map, &clauses, &idx);
 	}
 
-	return ((cfg_clausedef_t *)clauses) + idx;
+	return ((cfg_clausedef_external_t *)clauses) + idx;
 }
 
 static char *
@@ -4530,8 +4562,7 @@ map_define(cfg_obj_t *mapobj, cfg_obj_t *obj, const cfg_clausedef_t *clause) {
 	isc_symvalue_t symval;
 
 	map = mapobj->value.map;
-	result = isc_symtab_lookup(map->symtab, clause->name, SYMTAB_DUMMY_TYPE,
-				   &symval);
+	result = isc_symtab_lookup(map->symtab, "", clause->name, &symval);
 	if (result == ISC_R_NOTFOUND) {
 		if ((clause->flags & CFG_CLAUSEFLAG_MULTI) != 0) {
 			cfg_obj_t *destobj = NULL;
@@ -4547,9 +4578,8 @@ map_define(cfg_obj_t *mapobj, cfg_obj_t *obj, const cfg_clausedef_t *clause) {
 			symval.as_pointer = obj;
 		}
 
-		result = isc_symtab_define(map->symtab, clause->name,
-					   SYMTAB_DUMMY_TYPE, symval,
-					   isc_symexists_reject);
+		result = isc_symtab_define(map->symtab, "", clause->name,
+					   symval, isc_symexists_reject);
 		INSIST(result == ISC_R_SUCCESS);
 	} else {
 		cfg_obj_t *destobj = symval.as_pointer;
@@ -4570,16 +4600,16 @@ map_define(cfg_obj_t *mapobj, cfg_obj_t *obj, const cfg_clausedef_t *clause) {
 }
 
 isc_result_t
-cfg_map_add(cfg_obj_t *mapobj, cfg_obj_t *obj, const char *clausename) {
+cfg_map_add(cfg_obj_t *mapobj, cfg_obj_t *obj, enum cfg_clause clausename) {
 	const cfg_clausedef_t *clause;
 
 	REQUIRE(VALID_CFGOBJ(obj));
 	REQUIRE(VALID_CFGOBJ(mapobj));
 	REQUIRE(mapobj->type->rep == &cfg_rep_map);
-	REQUIRE(clausename != NULL);
+	REQUIRE(clausename != CFG_CLAUSE__NONE);
 
 	clause = cfg_map_findclause(mapobj->type, clausename);
-	if (clause == NULL || clause->name == NULL) {
+	if (clause == NULL || clause->name == CFG_CLAUSE__NONE) {
 		return ISC_R_FAILURE;
 	}
 
@@ -4595,7 +4625,7 @@ cfg_map_addclone(cfg_obj_t *map, const cfg_obj_t *obj,
 	REQUIRE(VALID_CFGOBJ(obj));
 	REQUIRE(VALID_CFGOBJ(map));
 	REQUIRE(map->type->rep == &cfg_rep_map);
-	REQUIRE(clause != NULL && clause->name != NULL);
+	REQUIRE(clause != NULL && clause->name != CFG_CLAUSE__NONE);
 
 	/*
 	 * Repeatable clauses aren't explicitly defined as cfg_list types,
@@ -4632,7 +4662,7 @@ cfg_map_addclone(cfg_obj_t *map, const cfg_obj_t *obj,
 
 static isc_result_t
 map_define_external(cfg_obj_t *mapobj, cfg_obj_t *obj,
-		    const cfg_clausedef_t *clause) {
+		    const cfg_clausedef_external_t *clause) {
 	isc_result_t result;
 	const cfg_map_external_t *map;
 	isc_symvalue_t symval;
@@ -4680,7 +4710,7 @@ map_define_external(cfg_obj_t *mapobj, cfg_obj_t *obj,
 isc_result_t
 cfg_map_external_add(cfg_obj_t *mapobj, cfg_obj_t *obj,
 		     const char *clausename) {
-	const cfg_clausedef_t *clause;
+	const cfg_clausedef_external_t *clause;
 
 	REQUIRE(VALID_CFGOBJ(obj));
 	REQUIRE(VALID_CFGOBJ(mapobj));
@@ -4697,7 +4727,7 @@ cfg_map_external_add(cfg_obj_t *mapobj, cfg_obj_t *obj,
 
 isc_result_t
 cfg_map_external_addclone(cfg_obj_t *map, const cfg_obj_t *obj,
-			  const cfg_clausedef_t *clause) {
+			  const cfg_clausedef_external_t *clause) {
 	isc_result_t result = ISC_R_SUCCESS;
 	cfg_obj_t *clone = NULL;
 
diff --git a/tests/isccfg/duration_test.c b/tests/isccfg/duration_test.c
index fbe63046a2f..888d270773b 100644
--- a/tests/isccfg/duration_test.c
+++ b/tests/isccfg/duration_test.c
@@ -32,6 +32,7 @@
 #include <isc/types.h>
 #include <isc/util.h>
 
+#include <isccfg/clause.h>
 #include <isccfg/cfg.h>
 #include <isccfg/grammar.h>
 #include <isccfg/namedconf.h>
@@ -151,7 +152,7 @@ ISC_RUN_TEST_IMPL(duration) {
 		}
 		assert_int_equal(result, ISC_R_SUCCESS);
 
-		(void)cfg_map_get(c1, "dnssec-policy", &kasps);
+		(void)cfg_map_get(c1, CFG_CLAUSE_DNSSEC_POLICY, &kasps);
 		assert_non_null(kasps);
 		CFG_LIST_FOREACH(kasps, element) {
 			const cfg_listelt_t *key_element;
@@ -165,7 +166,7 @@ ISC_RUN_TEST_IMPL(duration) {
 			assert_non_null(kconf);
 
 			kopts = cfg_tuple_get(kconf, "options");
-			result = cfg_map_get(kopts, "keys", &keys);
+			result = cfg_map_get(kopts, CFG_CLAUSE_KEYS, &keys);
 
 			key_element = cfg_list_first(keys);
 			assert_non_null(key_element);
diff --git a/tests/isccfg/parser_test.c b/tests/isccfg/parser_test.c
index 25d46ff7e7f..162462a4267 100644
--- a/tests/isccfg/parser_test.c
+++ b/tests/isccfg/parser_test.c
@@ -33,6 +33,7 @@
 #include <isc/types.h>
 #include <isc/util.h>
 
+#include <isccfg/clause.h>
 #include <isccfg/cfg.h>
 #include <isccfg/grammar.h>
 #include <isccfg/namedconf.h>
@@ -87,7 +88,7 @@ ISC_RUN_TEST_IMPL(addzoneconf) {
 		 * Mimic calling nzf_append() from bin/named/server.c
 		 * and check that the output matches the input.
 		 */
-		result = cfg_map_get(conf, "zone", &zlist);
+		result = cfg_map_get(conf, CFG_CLAUSE_ZONE, &zlist);
 		assert_int_equal(result, ISC_R_SUCCESS);
 
 		obj = cfg_listelt_value(cfg_list_first(zlist));