From: Štěpán Balážik <stepan@isc.org>
Date: Mon, 9 Feb 2026 18:22:44 +0000 (+0100)
Subject: Clean up imports of dnspython modules
X-Git-Tag: v9.21.19~15^2~2
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=d3186c70386040b2f51c08e73f1b850c1a2bcbf1;p=thirdparty%2Fbind9.git

Clean up imports of dnspython modules

Add a pylint plugin that enforces:
  - There is no bare `import dns` statement.
  - All `dns.<module>` used are explicitly imported.
  - There are no unused `dns.<module>` imports.

Fix all the imports to conform with this check.
---

diff --git a/bin/tests/system/bailiwick/tests_bailiwick.py b/bin/tests/system/bailiwick/tests_bailiwick.py
index 3fc647992df..8456cc6f514 100644
--- a/bin/tests/system/bailiwick/tests_bailiwick.py
+++ b/bin/tests/system/bailiwick/tests_bailiwick.py
@@ -13,6 +13,7 @@
 import time
 
 import dns.message
+import dns.rrset
 import pytest
 
 from isctest.instance import NamedInstance
diff --git a/bin/tests/system/checkds/tests_checkds.py b/bin/tests/system/checkds/tests_checkds.py
index 245ed5bf623..c0f834c42ba 100755
--- a/bin/tests/system/checkds/tests_checkds.py
+++ b/bin/tests/system/checkds/tests_checkds.py
@@ -18,8 +18,6 @@ import os
 import sys
 import time
 
-import dns.exception
-import dns.message
 import dns.name
 import dns.rcode
 import dns.rdataclass
diff --git a/bin/tests/system/cipher-suites/tests_cipher_suites.py b/bin/tests/system/cipher-suites/tests_cipher_suites.py
index 94d0f255b79..c20401bbce0 100644
--- a/bin/tests/system/cipher-suites/tests_cipher_suites.py
+++ b/bin/tests/system/cipher-suites/tests_cipher_suites.py
@@ -11,7 +11,7 @@
 
 from re import compile as Re
 
-import dns.message
+import dns.rcode
 import pytest
 
 import isctest
diff --git a/bin/tests/system/database/tests_database.py b/bin/tests/system/database/tests_database.py
index 89f818e9aa1..8e4a0e7ae45 100644
--- a/bin/tests/system/database/tests_database.py
+++ b/bin/tests/system/database/tests_database.py
@@ -9,7 +9,8 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-import dns
+
+import dns.rrset
 
 import isctest
 
diff --git a/bin/tests/system/digdelv/ans7/ans.py b/bin/tests/system/digdelv/ans7/ans.py
index 768c01e2249..0dde43c6a80 100644
--- a/bin/tests/system/digdelv/ans7/ans.py
+++ b/bin/tests/system/digdelv/ans7/ans.py
@@ -11,7 +11,6 @@
 
 from typing import AsyncGenerator
 
-import dns
 import dns.rcode
 
 from isctest.asyncserver import (
diff --git a/bin/tests/system/dns_import_checker.py b/bin/tests/system/dns_import_checker.py
new file mode 100644
index 00000000000..0af3252cdec
--- /dev/null
+++ b/bin/tests/system/dns_import_checker.py
@@ -0,0 +1,177 @@
+# Copyright (C) Internet Systems Consortium, Inc. ("ISC")
+#
+# SPDX-License-Identifier: MPL-2.0
+#
+# This Source Code Form is subject to the terms of the Mozilla Public
+# License, v. 2.0.  If a copy of the MPL was not distributed with this
+# file, you can obtain one at https://mozilla.org/MPL/2.0/.
+#
+# See the COPYRIGHT file distributed with this work for additional
+# information regarding copyright ownership.
+
+from pylint.checkers import BaseChecker
+
+import astroid
+
+
+class DnsExplicitImportsChecker(BaseChecker):
+    name = "dns-explicit-imports"
+
+    msgs = {
+        "W9001": (
+            "Bare 'import dns' is discouraged; import required submodules explicitly",
+            "dns-bare-import",
+            "Emitted when the package root 'dns' is imported directly.",
+        ),
+        "W9002": (
+            "Missing explicit import for '%s' (add `import %s`)",
+            "dns-missing-submodule-import",
+            "Emitted when code references dns.<...> but the corresponding module prefix "
+            "was not imported with `import dns.<...>`.",
+        ),
+        "W9003": (
+            "Unused explicit import for '%s' (remove `import %s`)",
+            "dns-unused-submodule-import",
+            "Emitted when a dns.<...> module is imported explicitly but not used.",
+        ),
+    }
+
+    def __init__(self, linter=None):
+        super().__init__(linter)
+        self._imported = {}
+        self._imported_aliases = set()
+        self._required = {}
+
+    def visit_module(self, node):  # pylint: disable=unused-argument
+        self._imported = {}
+        self._imported_aliases = set()
+        self._required = {}
+
+    def leave_module(self, node):  # pylint: disable=unused-argument
+        for mod, use_node in sorted(self._required.items()):
+            if mod in self._imported:
+                continue
+            prefix = mod + "."
+            if any(name.startswith(prefix) for name in self._imported):
+                continue
+            self.add_message(
+                "dns-missing-submodule-import",
+                node=use_node,
+                args=(mod, mod),
+            )
+        for mod, import_node in sorted(self._imported.items()):
+            if mod in self._imported_aliases:
+                continue
+            if any(
+                name == mod or name.startswith(mod + ".") for name in self._required
+            ):
+                continue
+            self.add_message(
+                "dns-unused-submodule-import",
+                node=import_node,
+                args=(mod, mod),
+            )
+
+    def visit_import(self, node):
+        for name, _asname in node.names:
+            if name == "dns":
+                self.add_message("dns-bare-import", node=node)
+                continue
+            if name.startswith("dns."):
+                self._imported.setdefault(name, node)
+                if _asname:
+                    self._imported_aliases.add(name)
+
+    def visit_importfrom(self, node):  # pylint: disable=unused-argument
+        return
+
+    def visit_attribute(self, node):
+        parent = node.parent
+        # For `dns.a.b.c`, astroid visits intermediate attributes too.
+        # Process only the rightmost node to avoid duplicate bookkeeping.
+        if isinstance(parent, astroid.nodes.Attribute) and parent.expr is node:
+            return
+
+        mod = self._dns_module_for_attribute(node)
+        if mod is None:
+            return
+
+        self._required.setdefault(mod, node)
+
+    @staticmethod
+    def _dns_attribute_nodes(node):
+        """
+        Return the chain of Attribute nodes as a list.
+
+        For `dns.a.b.c`, return the list of Attribute nodes for `dns.a`, `dns.a.b`, and `dns.a.b.c`.
+
+        Return None if the chain is not rooted in `dns`.
+        """
+
+        if not isinstance(node, astroid.nodes.Attribute):
+            return None
+
+        nodes = []
+        expr = node
+        while isinstance(expr, astroid.nodes.Attribute):
+            nodes.append(expr)
+            expr = expr.expr
+
+        if not isinstance(expr, astroid.nodes.Name) or expr.name != "dns":
+            return None
+
+        return list(reversed(nodes))
+
+    @classmethod
+    def _dns_module_for_attribute(cls, node):
+        """
+        For dns.a.b.c, return the longest dns.a.b... prefix that is likely to be a module,
+        or None if the chain is not rooted in dns.
+        """
+        last_module = None
+        chain_nodes = cls._dns_attribute_nodes(node)
+        if chain_nodes is None:
+            return None
+
+        full = "dns." + ".".join(part.attrname for part in chain_nodes)
+        # Prefer inferred module names to avoid treating classes/constants as
+        # modules (e.g. `dns.name.NameRelation` should resolve to `dns.name`).
+        for chain_node in chain_nodes:
+            inferred = cls._infer_module_name(chain_node)
+            if inferred is not None and full.startswith(inferred):
+                last_module = inferred
+        if last_module is not None:
+            return last_module
+
+        # Fallback when inference is unavailable: assume the terminal segment
+        # is not a module symbol and require the parent path.
+        parts = full.split(".")
+        if len(parts) <= 2:
+            return full
+        return ".".join(parts[:-1])
+
+    @staticmethod
+    def _infer_module_name(node):
+        """Infer `dns.<module>` for a node; return None if inference is unsure."""
+        try:
+            for inferred in node.infer():
+                if inferred is astroid.util.Uninferable:
+                    continue
+                # Inference can return either a Module node directly or another
+                # symbol rooted in a module; normalize both to module name.
+                module = (
+                    inferred
+                    if isinstance(inferred, astroid.nodes.Module)
+                    else inferred.root()
+                )
+                name = module.name
+                if name.startswith("dns."):
+                    return name
+        # Inference can fail for dynamic/partial code; fall back gracefully.
+        except astroid.AstroidError:
+            pass
+        return None
+
+
+def register(linter):
+    linter.register_checker(DnsExplicitImportsChecker(linter))
diff --git a/bin/tests/system/dnssec-malformed-dnskey/tests_malformed_dnskey.py b/bin/tests/system/dnssec-malformed-dnskey/tests_malformed_dnskey.py
index efb5839ddc6..cdb8932e7cd 100644
--- a/bin/tests/system/dnssec-malformed-dnskey/tests_malformed_dnskey.py
+++ b/bin/tests/system/dnssec-malformed-dnskey/tests_malformed_dnskey.py
@@ -17,8 +17,11 @@ import os
 from cryptography.hazmat.primitives.asymmetric import ec
 from dns.rdtypes.dnskeybase import Flag
 
-import dns
 import dns.dnssec
+import dns.name
+import dns.rdataclass
+import dns.rdatatype
+import dns.rdtypes.ANY.RRSIG
 import dns.zone
 import pytest
 
diff --git a/bin/tests/system/dnstap/tests_dnstap.py b/bin/tests/system/dnstap/tests_dnstap.py
index 9004c45e834..1ec4cc17cf5 100644
--- a/bin/tests/system/dnstap/tests_dnstap.py
+++ b/bin/tests/system/dnstap/tests_dnstap.py
@@ -14,6 +14,7 @@
 import os
 import re
 
+import dns.rcode
 import dns.rrset
 import pytest
 
diff --git a/bin/tests/system/doth/tests_gnutls.py b/bin/tests/system/doth/tests_gnutls.py
index 16ecdb5073a..7053311debd 100644
--- a/bin/tests/system/doth/tests_gnutls.py
+++ b/bin/tests/system/doth/tests_gnutls.py
@@ -16,8 +16,8 @@ import struct
 import subprocess
 import time
 
-import dns
 import dns.exception
+import dns.message
 import dns.name
 import dns.rdataclass
 import dns.rdatatype
diff --git a/bin/tests/system/filters/common.py b/bin/tests/system/filters/common.py
index 6db8f197564..12542a9ab60 100644
--- a/bin/tests/system/filters/common.py
+++ b/bin/tests/system/filters/common.py
@@ -11,7 +11,7 @@
 
 from dns import rdataclass, rdatatype
 
-import dns
+import dns.name
 
 import isctest
 
diff --git a/bin/tests/system/filters/tests_filter_aaaa_v4.py b/bin/tests/system/filters/tests_filter_aaaa_v4.py
index adf46add049..7f5e612865b 100644
--- a/bin/tests/system/filters/tests_filter_aaaa_v4.py
+++ b/bin/tests/system/filters/tests_filter_aaaa_v4.py
@@ -18,7 +18,6 @@ from filters.common import (
     prime_cache,
 )
 
-import isctest
 import isctest.mark
 
 pytestmark = pytest.mark.extra_artifacts(ARTIFACTS)
diff --git a/bin/tests/system/glue/tests_glue.py b/bin/tests/system/glue/tests_glue.py
index 93b0164c39b..4b08515535d 100644
--- a/bin/tests/system/glue/tests_glue.py
+++ b/bin/tests/system/glue/tests_glue.py
@@ -10,6 +10,7 @@
 # information regarding copyright ownership.
 
 
+import dns.edns
 import dns.flags
 import dns.message
 import pytest
diff --git a/bin/tests/system/hooks/tests_hooks.py b/bin/tests/system/hooks/tests_hooks.py
index 75305e9b353..247ac9a10b8 100644
--- a/bin/tests/system/hooks/tests_hooks.py
+++ b/bin/tests/system/hooks/tests_hooks.py
@@ -13,7 +13,7 @@ import glob
 import os
 import subprocess
 
-import dns
+import dns.rcode
 import pytest
 
 import isctest
diff --git a/bin/tests/system/isctest/asyncserver.py b/bin/tests/system/isctest/asyncserver.py
index 0dfc19b1196..453751629f0 100644
--- a/bin/tests/system/isctest/asyncserver.py
+++ b/bin/tests/system/isctest/asyncserver.py
@@ -40,7 +40,6 @@ import dns.rdataset
 import dns.rdatatype
 import dns.rrset
 import dns.tsig
-import dns.version
 import dns.zone
 
 _UdpHandler = Callable[
diff --git a/bin/tests/system/isctest/check.py b/bin/tests/system/isctest/check.py
index c7e89a217c0..7c5e30c4e12 100644
--- a/bin/tests/system/isctest/check.py
+++ b/bin/tests/system/isctest/check.py
@@ -21,6 +21,7 @@ import dns.edns
 import dns.flags
 import dns.message
 import dns.rcode
+import dns.rrset
 import dns.zone
 
 import isctest.log
diff --git a/bin/tests/system/isctest/hypothesis/strategies.py b/bin/tests/system/isctest/hypothesis/strategies.py
index 60d42dcea7b..e5355eb3e0d 100644
--- a/bin/tests/system/isctest/hypothesis/strategies.py
+++ b/bin/tests/system/isctest/hypothesis/strategies.py
@@ -26,7 +26,6 @@ from hypothesis.strategies import (
     sampled_from,
 )
 
-import dns.message
 import dns.name
 import dns.rdataclass
 import dns.rdatatype
diff --git a/bin/tests/system/isctest/instance.py b/bin/tests/system/isctest/instance.py
index cb542d79951..2786f66e5d9 100644
--- a/bin/tests/system/isctest/instance.py
+++ b/bin/tests/system/isctest/instance.py
@@ -17,6 +17,7 @@ from typing import NamedTuple
 import os
 import re
 
+import dns.exception
 import dns.rcode
 import dns.update
 
diff --git a/bin/tests/system/isctest/kasp.py b/bin/tests/system/isctest/kasp.py
index 29db2a55bfa..1d4e8e67520 100644
--- a/bin/tests/system/isctest/kasp.py
+++ b/bin/tests/system/isctest/kasp.py
@@ -20,11 +20,17 @@ import os
 import re
 import time
 
-import dns
 import dns.dnssec
+import dns.exception
+import dns.message
+import dns.name
+import dns.rcode
+import dns.rdataclass
 import dns.rdatatype
 import dns.rrset
 import dns.tsig
+import dns.zone
+import dns.zonefile
 
 from isctest.instance import NamedInstance
 from isctest.run import EnvCmd
diff --git a/bin/tests/system/isctest/query.py b/bin/tests/system/isctest/query.py
index 9fc29e0008f..7c767be167d 100644
--- a/bin/tests/system/isctest/query.py
+++ b/bin/tests/system/isctest/query.py
@@ -14,8 +14,12 @@ from typing import Any, Callable
 import os
 import time
 
+import dns.exception
+import dns.flags
 import dns.message
 import dns.query
+import dns.rcode
+import dns.rdataclass
 
 import isctest.log
 
diff --git a/bin/tests/system/isctest/util.py b/bin/tests/system/isctest/util.py
index eec03ae7243..7ffce13b8ed 100644
--- a/bin/tests/system/isctest/util.py
+++ b/bin/tests/system/isctest/util.py
@@ -9,6 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
+import dns.rrset
 import dns.zone
 import pytest
 
diff --git a/bin/tests/system/kasp/tests_kasp.py b/bin/tests/system/kasp/tests_kasp.py
index cc041dff86c..0c4f42ffda7 100644
--- a/bin/tests/system/kasp/tests_kasp.py
+++ b/bin/tests/system/kasp/tests_kasp.py
@@ -16,7 +16,12 @@ import shutil
 import subprocess
 import time
 
-import dns
+import dns.exception
+import dns.name
+import dns.rcode
+import dns.rdataclass
+import dns.rdatatype
+import dns.tsig
 import dns.update
 import pytest
 
diff --git a/bin/tests/system/limits/tests_limits.py b/bin/tests/system/limits/tests_limits.py
index 512c02ecca1..c7498a22ecd 100644
--- a/bin/tests/system/limits/tests_limits.py
+++ b/bin/tests/system/limits/tests_limits.py
@@ -11,6 +11,7 @@
 
 import itertools
 
+import dns.flags
 import dns.rrset
 import pytest
 
diff --git a/bin/tests/system/migrate2kasp/tests_migrate2kasp.py b/bin/tests/system/migrate2kasp/tests_migrate2kasp.py
index 26f1e34ade4..3e4150ee7f6 100644
--- a/bin/tests/system/migrate2kasp/tests_migrate2kasp.py
+++ b/bin/tests/system/migrate2kasp/tests_migrate2kasp.py
@@ -18,7 +18,6 @@ import pytest
 from isctest.vars.algorithms import Algorithm
 
 import isctest
-import isctest.mark
 
 pytestmark = pytest.mark.extra_artifacts(
     [
diff --git a/bin/tests/system/multisigner/tests_multisigner.py b/bin/tests/system/multisigner/tests_multisigner.py
index 1ea3ddd6d81..d3db8ad1630 100644
--- a/bin/tests/system/multisigner/tests_multisigner.py
+++ b/bin/tests/system/multisigner/tests_multisigner.py
@@ -14,7 +14,10 @@ from re import compile as Re
 
 import os
 
-import dns
+import dns.name
+import dns.rcode
+import dns.rdataclass
+import dns.rdatatype
 import dns.update
 import pytest
 
diff --git a/bin/tests/system/nsec3-answer/tests_nsec3.py b/bin/tests/system/nsec3-answer/tests_nsec3.py
index a53484ee332..bed0aadc280 100755
--- a/bin/tests/system/nsec3-answer/tests_nsec3.py
+++ b/bin/tests/system/nsec3-answer/tests_nsec3.py
@@ -26,7 +26,6 @@ from hypothesis import assume, given
 import dns.dnssec
 import dns.message
 import dns.name
-import dns.query
 import dns.rcode
 import dns.rdataclass
 import dns.rdatatype
diff --git a/bin/tests/system/nsec3/common.py b/bin/tests/system/nsec3/common.py
index 542af0e622e..2f03f9bb35f 100644
--- a/bin/tests/system/nsec3/common.py
+++ b/bin/tests/system/nsec3/common.py
@@ -11,7 +11,9 @@
 
 from datetime import timedelta
 
-import dns
+import dns.rcode
+import dns.rdataclass
+import dns.rdatatype
 import pytest
 
 import isctest
diff --git a/bin/tests/system/nsec3/tests_nsec3_change.py b/bin/tests/system/nsec3/tests_nsec3_change.py
index 9b9104cb7f1..b8a8b066e36 100644
--- a/bin/tests/system/nsec3/tests_nsec3_change.py
+++ b/bin/tests/system/nsec3/tests_nsec3_change.py
@@ -12,15 +12,15 @@
 import shutil
 import time
 
-import dns
-import dns.update
+import dns.name
+import dns.rdataclass
+import dns.rdatatype
 import pytest
 
 from isctest.vars.algorithms import Algorithm
 from nsec3.common import NSEC3_MARK, check_nsec3_case
 
 import isctest
-import isctest.mark
 
 pytestmark = NSEC3_MARK
 
diff --git a/bin/tests/system/nsec3/tests_nsec3_initial.py b/bin/tests/system/nsec3/tests_nsec3_initial.py
index 465f11a76eb..0cc53c81aa4 100644
--- a/bin/tests/system/nsec3/tests_nsec3_initial.py
+++ b/bin/tests/system/nsec3/tests_nsec3_initial.py
@@ -11,7 +11,7 @@
 
 import os
 
-import dns
+import dns.rcode
 import dns.update
 import pytest
 
diff --git a/bin/tests/system/nsec3/tests_nsec3_reconfig.py b/bin/tests/system/nsec3/tests_nsec3_reconfig.py
index 2a0bfecb274..9efc486791d 100644
--- a/bin/tests/system/nsec3/tests_nsec3_reconfig.py
+++ b/bin/tests/system/nsec3/tests_nsec3_reconfig.py
@@ -12,8 +12,10 @@
 import os
 import time
 
-import dns
-import dns.update
+import dns.name
+import dns.rcode
+import dns.rdataclass
+import dns.rdatatype
 import pytest
 
 from isctest.vars.algorithms import RSASHA1, Algorithm
diff --git a/bin/tests/system/nsec3/tests_nsec3_restart.py b/bin/tests/system/nsec3/tests_nsec3_restart.py
index b553ad120eb..ca6ebef8118 100644
--- a/bin/tests/system/nsec3/tests_nsec3_restart.py
+++ b/bin/tests/system/nsec3/tests_nsec3_restart.py
@@ -11,15 +11,13 @@
 
 import os
 
-import dns
-import dns.update
+import dns.rdatatype
 import pytest
 
 from isctest.vars.algorithms import Algorithm
 from nsec3.common import NSEC3_MARK, check_nsec3_case, check_nsec3param
 
 import isctest
-import isctest.mark
 
 pytestmark = NSEC3_MARK
 
diff --git a/bin/tests/system/nsec3/tests_nsec3_retransfer.py b/bin/tests/system/nsec3/tests_nsec3_retransfer.py
index ff0208593da..4df768cc00f 100644
--- a/bin/tests/system/nsec3/tests_nsec3_retransfer.py
+++ b/bin/tests/system/nsec3/tests_nsec3_retransfer.py
@@ -13,14 +13,13 @@ from datetime import timedelta
 
 import os
 
-import dns
-import dns.update
+import dns.rcode
+import dns.rdatatype
 
 from isctest.vars.algorithms import RSASHA256
 from nsec3.common import NSEC3_MARK, check_auth_nsec3, check_nsec3param
 
 import isctest
-import isctest.mark
 
 pytestmark = NSEC3_MARK
 
diff --git a/bin/tests/system/optout/tests_optout.py b/bin/tests/system/optout/tests_optout.py
index 3944649f2d8..ef157b3e9e4 100755
--- a/bin/tests/system/optout/tests_optout.py
+++ b/bin/tests/system/optout/tests_optout.py
@@ -16,14 +16,9 @@ import os
 import re
 import sys
 
-import dns
-import dns.exception
-import dns.message
-import dns.name
 import dns.query
 import dns.rcode
-import dns.rdataclass
-import dns.rdatatype
+import dns.zone
 import pytest
 
 import isctest
diff --git a/bin/tests/system/qmin/ans2/ans.py b/bin/tests/system/qmin/ans2/ans.py
index 20172a87b6c..5d35903da83 100644
--- a/bin/tests/system/qmin/ans2/ans.py
+++ b/bin/tests/system/qmin/ans2/ans.py
@@ -13,7 +13,6 @@ information regarding copyright ownership.
 
 from typing import AsyncGenerator
 
-import dns.message
 import dns.name
 import dns.rcode
 import dns.rdatatype
diff --git a/bin/tests/system/rollover-multisigner/tests_rollover_multisigner.py b/bin/tests/system/rollover-multisigner/tests_rollover_multisigner.py
index c0c06f4b61f..235ef99b6db 100644
--- a/bin/tests/system/rollover-multisigner/tests_rollover_multisigner.py
+++ b/bin/tests/system/rollover-multisigner/tests_rollover_multisigner.py
@@ -13,7 +13,6 @@ from datetime import timedelta
 
 import os
 
-import dns
 import dns.update
 
 from isctest.kasp import Iret, SettimeOptions
diff --git a/bin/tests/system/rpzextra/tests_rpzextra.py b/bin/tests/system/rpzextra/tests_rpzextra.py
index 5eedc45e274..904c6f03ac5 100644
--- a/bin/tests/system/rpzextra/tests_rpzextra.py
+++ b/bin/tests/system/rpzextra/tests_rpzextra.py
@@ -13,7 +13,6 @@
 
 import os
 
-import dns
 import dns.rcode
 import dns.rrset
 import pytest
diff --git a/bin/tests/system/selftest/tests_zone_analyzer.py b/bin/tests/system/selftest/tests_zone_analyzer.py
index 671ca877518..61141344281 100755
--- a/bin/tests/system/selftest/tests_zone_analyzer.py
+++ b/bin/tests/system/selftest/tests_zone_analyzer.py
@@ -21,11 +21,9 @@ import itertools
 
 from dns.name import Name
 
-import dns
 import dns.name
 import pytest
 
-import isctest
 import isctest.name
 
 # set of properies present in the tested zone - read by tests_zone_analyzer.py
diff --git a/bin/tests/system/showconf/tests_showconf.py b/bin/tests/system/showconf/tests_showconf.py
index b8bab680b62..77c705535e1 100644
--- a/bin/tests/system/showconf/tests_showconf.py
+++ b/bin/tests/system/showconf/tests_showconf.py
@@ -9,7 +9,7 @@
 # See the COPYRIGHT file distributed with this work for additional
 # information regarding copyright ownership.
 
-import dns
+import dns.rcode
 
 import isctest
 
diff --git a/bin/tests/system/shutdown/tests_shutdown.py b/bin/tests/system/shutdown/tests_shutdown.py
index 831f85c449f..aaa7cbad774 100755
--- a/bin/tests/system/shutdown/tests_shutdown.py
+++ b/bin/tests/system/shutdown/tests_shutdown.py
@@ -20,7 +20,6 @@ import signal
 import subprocess
 import time
 
-import dns
 import dns.exception
 import pytest
 
diff --git a/bin/tests/system/statschannel/generic.py b/bin/tests/system/statschannel/generic.py
index 3e317087ebd..0b0ee82de05 100644
--- a/bin/tests/system/statschannel/generic.py
+++ b/bin/tests/system/statschannel/generic.py
@@ -16,8 +16,6 @@ from time import sleep
 import os
 
 import dns.message
-import dns.query
-import dns.rcode
 
 import isctest
 
diff --git a/bin/tests/system/stress/tests_stress_update.py b/bin/tests/system/stress/tests_stress_update.py
index ef98b411374..5864335c46b 100644
--- a/bin/tests/system/stress/tests_stress_update.py
+++ b/bin/tests/system/stress/tests_stress_update.py
@@ -12,6 +12,8 @@
 import concurrent.futures
 import time
 
+import dns.exception
+import dns.rcode
 import dns.update
 import pytest
 
diff --git a/bin/tests/system/stub/tests_stub.py b/bin/tests/system/stub/tests_stub.py
index 2c9bd00cd60..8cf87c7ad83 100644
--- a/bin/tests/system/stub/tests_stub.py
+++ b/bin/tests/system/stub/tests_stub.py
@@ -12,7 +12,7 @@
 
 import os
 
-import dns.message
+import dns.rrset
 import pytest
 
 import isctest
diff --git a/bin/tests/system/synthrecord/tests_synthrecord.py b/bin/tests/system/synthrecord/tests_synthrecord.py
index 7fbd5d7f0cc..3579b7a33d9 100644
--- a/bin/tests/system/synthrecord/tests_synthrecord.py
+++ b/bin/tests/system/synthrecord/tests_synthrecord.py
@@ -24,7 +24,9 @@ from hypothesis import assume, example, given
 from hypothesis.strategies import ip_addresses
 
 import dns.message
-import dns.reversename
+import dns.name
+import dns.rcode
+import dns.rrset
 import pytest
 
 from isctest.hypothesis.strategies import dns_names
diff --git a/bin/tests/system/tcp/tests_tcp.py b/bin/tests/system/tcp/tests_tcp.py
index 62d2f45a8c8..46c391c2455 100644
--- a/bin/tests/system/tcp/tests_tcp.py
+++ b/bin/tests/system/tcp/tests_tcp.py
@@ -15,9 +15,11 @@ import socket
 import struct
 import time
 
-import dns
+import dns.flags
 import dns.message
+import dns.name
 import dns.query
+import dns.rrset
 import pytest
 
 pytestmark = pytest.mark.extra_artifacts(
diff --git a/bin/tests/system/timeouts/tests_tcp_timeouts.py b/bin/tests/system/timeouts/tests_tcp_timeouts.py
index 478c0a34588..0d0660bd819 100644
--- a/bin/tests/system/timeouts/tests_tcp_timeouts.py
+++ b/bin/tests/system/timeouts/tests_tcp_timeouts.py
@@ -14,7 +14,6 @@
 import socket
 import time
 
-import dns
 import dns.edns
 import dns.message
 import dns.name
diff --git a/bin/tests/system/tsig/tests_badtime.py b/bin/tests/system/tsig/tests_badtime.py
index 9981463346e..7da1ef7357e 100644
--- a/bin/tests/system/tsig/tests_badtime.py
+++ b/bin/tests/system/tsig/tests_badtime.py
@@ -16,6 +16,7 @@ import time
 
 import dns.message
 import dns.query
+import dns.tsig
 import dns.tsigkeyring
 import pytest
 
diff --git a/bin/tests/system/tsiggss/tests_isc_spnego_flaws.py b/bin/tests/system/tsiggss/tests_isc_spnego_flaws.py
index 01e86e0fa9b..3193ea6c3fe 100755
--- a/bin/tests/system/tsiggss/tests_isc_spnego_flaws.py
+++ b/bin/tests/system/tsiggss/tests_isc_spnego_flaws.py
@@ -20,8 +20,6 @@ import argparse
 import struct
 import time
 
-import dns
-import dns.message
 import dns.name
 import dns.rdata
 import dns.rdataclass
diff --git a/bin/tests/system/wildcard/tests_wildcard.py b/bin/tests/system/wildcard/tests_wildcard.py
index dfe0dc83148..3ea3fdc7d3e 100755
--- a/bin/tests/system/wildcard/tests_wildcard.py
+++ b/bin/tests/system/wildcard/tests_wildcard.py
@@ -33,11 +33,7 @@ Limitations - untested properties:
 
 from hypothesis import assume, example, given, settings
 
-import dns
-import dns.message
 import dns.name
-import dns.query
-import dns.rcode
 import dns.rdataclass
 import dns.rdatatype
 import dns.rrset
diff --git a/bin/tests/system/xfer/tests_xfer.py b/bin/tests/system/xfer/tests_xfer.py
index d3c16cc24d4..8aabb3a46a3 100644
--- a/bin/tests/system/xfer/tests_xfer.py
+++ b/bin/tests/system/xfer/tests_xfer.py
@@ -18,6 +18,11 @@ import socket
 import time
 
 import dns.message
+import dns.query
+import dns.rdataclass
+import dns.rdatatype
+import dns.tsig
+import dns.zone
 import pytest
 
 from isctest.util import param
diff --git a/bin/tests/system/xferquota/tests_xferquota.py b/bin/tests/system/xferquota/tests_xferquota.py
index ba599471d5d..6d255085cb5 100644
--- a/bin/tests/system/xferquota/tests_xferquota.py
+++ b/bin/tests/system/xferquota/tests_xferquota.py
@@ -18,7 +18,7 @@ import shutil
 import signal
 import time
 
-import dns.message
+import dns.zone
 import pytest
 
 import isctest
diff --git a/pyproject.toml b/pyproject.toml
index 88652777d50..916b886cdaf 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -58,6 +58,7 @@ source-roots = [
 ]
 load-plugins = [
   "re_compile_checker",
+  "dns_import_checker",
 ]
 
 [tool.vulture]
@@ -72,6 +73,7 @@ exclude = [
   "doc/man/conf.py",
   "isctest",
   "re_compile_checker.py",
+  "dns_import_checker.py",
 ]
 ignore_decorators = [
   "@pytest.fixture",