From: Ondřej Surý <ondrej@isc.org>
Date: Fri, 14 Aug 2026 07:26:13 +0000 (+0200)
Subject: Apply the semantic patch cocci/dns_name_isroot.spatch
X-Git-Url: http://git.ipfire.org/cgi-bin/gitweb.cgi?a=commitdiff_plain;h=e4e395a64593f17600e1b26bf7e63de2925592d1;p=thirdparty%2Fbind9.git

Apply the semantic patch cocci/dns_name_isroot.spatch

This replaces the dns_name_countlabels() with constant time
dns_name_isroot() and dns_name_belowroot() helpers.
---

diff --git a/bin/check/check-tool.c b/bin/check/check-tool.c
index 39ba810fb2b..bc4ada78feb 100644
--- a/bin/check/check-tool.c
+++ b/bin/check/check-tool.c
@@ -157,7 +157,7 @@ checkisservedby(dns_zone_t *zone, dns_rdatatype_t type,
 	/*
 	 * Turn off search.
 	 */
-	if (dns_name_countlabels(name) > 1U) {
+	if (dns_name_belowroot(name)) {
 		strlcat(namebuf, ".", sizeof(namebuf));
 	}
 	eai = getaddrinfo(namebuf, NULL, &hints, &ai);
@@ -244,7 +244,7 @@ checkns(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner,
 	/*
 	 * Turn off search.
 	 */
-	if (dns_name_countlabels(name) > 1U) {
+	if (dns_name_belowroot(name)) {
 		strlcat(namebuf, ".", sizeof(namebuf));
 	}
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));
@@ -445,7 +445,7 @@ checkmx(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 	/*
 	 * Turn off search.
 	 */
-	if (dns_name_countlabels(name) > 1U) {
+	if (dns_name_belowroot(name)) {
 		strlcat(namebuf, ".", sizeof(namebuf));
 	}
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));
@@ -534,7 +534,7 @@ checksrv(dns_zone_t *zone, const dns_name_t *name, const dns_name_t *owner) {
 	/*
 	 * Turn off search.
 	 */
-	if (dns_name_countlabels(name) > 1U) {
+	if (dns_name_belowroot(name)) {
 		strlcat(namebuf, ".", sizeof(namebuf));
 	}
 	dns_name_format(owner, ownerbuf, sizeof(ownerbuf));
diff --git a/bin/named/server.c b/bin/named/server.c
index e9e018a97ee..3b1ef0ab50f 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -1903,7 +1903,7 @@ configure_rpz_zone(dns_view_t *view, const cfg_listelt_t *element,
 	str = cfg_obj_asstring(cfg_tuple_get(rpz_obj, "zone name"));
 	RETERR(configure_rpz_name(view, rpz_obj, &zone->origin, str, "zone"));
 
-	if (dns_name_equal(&zone->origin, dns_rootname)) {
+	if (dns_name_isroot(&zone->origin)) {
 		cfg_obj_log(rpz_obj, DNS_RPZ_ERROR_LEVEL,
 			    "invalid zone name '%s'", str);
 		return DNS_R_EMPTYLABEL;
@@ -2635,7 +2635,7 @@ configure_catz_zone(dns_view_t *view, dns_view_t *pview,
 
 	result = dns_name_fromstring(&origin, str, dns_rootname,
 				     DNS_NAME_DOWNCASE, view->mctx);
-	if (result == ISC_R_SUCCESS && dns_name_equal(&origin, dns_rootname)) {
+	if (result == ISC_R_SUCCESS && dns_name_isroot(&origin)) {
 		result = DNS_R_EMPTYLABEL;
 	}
 
@@ -6103,7 +6103,7 @@ configure_zone(const cfg_obj_t *config, const cfg_obj_t *zconfig,
 				      "zone '%s': 'file' not specified", zname);
 			CLEANUP(ISC_R_FAILURE);
 		}
-		if (dns_name_equal(origin, dns_rootname)) {
+		if (dns_name_isroot(origin)) {
 			const char *hintsfile = cfg_obj_asstring(fileobj);
 
 			CHECK(configure_rootdb(view, hintsfile));
@@ -11476,7 +11476,7 @@ flushnode_cache(dns_view_t *view, const dns_name_t *name, const char *target,
 	 * if some of the views share a single cache.  But since the
 	 * operation is lightweight we prefer simplicity here.
 	 */
-	if (dns_name_equal(name, dns_rootname)) {
+	if (dns_name_isroot(name)) {
 		result = dns_view_flushcache(view, false);
 	} else {
 		result = dns_view_flushnode(view, name, tree);
@@ -12574,7 +12574,7 @@ named_server_changezone(named_server_t *server, char *command,
 	CHECK(dns_name_fromtext(dnsname, &buf, dns_rootname, 0));
 
 	if (redirect) {
-		if (!dns_name_equal(dnsname, dns_rootname)) {
+		if (!dns_name_isroot(dnsname)) {
 			(void)putstr(text, "redirect zones must be called "
 					   "\".\"");
 			CLEANUP(ISC_R_FAILURE);
diff --git a/bin/named/zoneconf.c b/bin/named/zoneconf.c
index 64be4515c2a..b67db5c1535 100644
--- a/bin/named/zoneconf.c
+++ b/bin/named/zoneconf.c
@@ -1536,7 +1536,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 
 			CHECK(dns_name_fromstring(rad, adstr, dns_rootname, 0,
 						  mctx));
-			if (logreports || dns_name_equal(rad, dns_rootname)) {
+			if (logreports || dns_name_isroot(rad)) {
 				/* Disable RC for error-logging zones or root */
 				dns_zone_setrad(zone, NULL);
 			} else if (dns_name_equal(rad, zn)) {
@@ -1883,7 +1883,7 @@ named_zone_configure(const cfg_obj_t *config, const cfg_obj_t *vconfig,
 		 * explicitly specified and this is a root zone mirror.
 		 */
 		if (obj == NULL && ztype == dns_zone_mirror &&
-		    dns_name_equal(dns_zone_getorigin(zone), dns_rootname))
+		    dns_name_isroot(dns_zone_getorigin(zone)))
 		{
 			result = named_config_getremotesdef(
 				config, "remote-servers",
diff --git a/bin/nsupdate/nsupdate.c b/bin/nsupdate/nsupdate.c
index c4534a1f519..75934d1b43a 100644
--- a/bin/nsupdate/nsupdate.c
+++ b/bin/nsupdate/nsupdate.c
@@ -3402,7 +3402,7 @@ start_update(void) {
 		 */
 		tmprdataset = ISC_LIST_HEAD(firstname->list);
 		if (section == DNS_SECTION_UPDATE &&
-		    !dns_name_equal(firstname, dns_rootname) &&
+		    !dns_name_isroot(firstname) &&
 		    tmprdataset->type == dns_rdatatype_ds)
 		{
 			unsigned int labels = dns_name_countlabels(name);
diff --git a/lib/dns/cache.c b/lib/dns/cache.c
index 6c070dd9c27..debe9155d2b 100644
--- a/lib/dns/cache.c
+++ b/lib/dns/cache.c
@@ -418,7 +418,7 @@ dns_cache_flushnode(dns_cache_t *cache, const dns_name_t *name, bool tree) {
 	dns_dbnode_t *node = NULL;
 	dns_db_t *db = NULL;
 
-	REQUIRE(!(tree && dns_name_equal(name, dns_rootname)));
+	REQUIRE(!(tree && dns_name_isroot(name)));
 
 	LOCK(&cache->lock);
 	if (cache->db != NULL) {
diff --git a/lib/dns/message.c b/lib/dns/message.c
index 94618bb4743..474bcc1016e 100644
--- a/lib/dns/message.c
+++ b/lib/dns/message.c
@@ -1177,7 +1177,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t dctx,
 			 * must be in the additional data section, and
 			 * it must be the first OPT we've seen.
 			 */
-			if (!dns_name_equal(dns_rootname, name) ||
+			if (!dns_name_isroot(name) ||
 			    sectionid != DNS_SECTION_ADDITIONAL ||
 			    msg->opt != NULL)
 			{
@@ -1275,7 +1275,7 @@ getsection(isc_buffer_t *source, dns_message_t *msg, dns_decompress_t dctx,
 			if (covers == dns_rdatatype_none) {
 				if (sectionid != DNS_SECTION_ADDITIONAL ||
 				    count != msg->counts[sectionid] - 1 ||
-				    !dns_name_equal(name, dns_rootname))
+				    !dns_name_isroot(name))
 				{
 					DO_ERROR(DNS_R_BADSIG0);
 				} else {
diff --git a/lib/dns/rdata.c b/lib/dns/rdata.c
index dc6931ea106..954f4149939 100644
--- a/lib/dns/rdata.c
+++ b/lib/dns/rdata.c
@@ -2001,7 +2001,7 @@ name_prefix(dns_name_t *name, const dns_name_t *origin, dns_name_t *target) {
 		goto return_false;
 	}
 
-	if (dns_name_compare(origin, dns_rootname) == 0) {
+	if (dns_name_isroot(origin)) {
 		goto return_false;
 	}
 
diff --git a/lib/dns/rdata/generic/dsync_66.c b/lib/dns/rdata/generic/dsync_66.c
index ca121fb78dd..2056a7260ce 100644
--- a/lib/dns/rdata/generic/dsync_66.c
+++ b/lib/dns/rdata/generic/dsync_66.c
@@ -300,7 +300,7 @@ additionaldata_dsync(ARGS_ADDLDATA) {
 	isc_region_consume(&region, 5);
 	dns_name_fromregion(&name, &region);
 
-	if (dns_name_equal(&name, dns_rootname)) {
+	if (dns_name_isroot(&name)) {
 		return ISC_R_SUCCESS;
 	}
 
diff --git a/lib/dns/rdata/generic/mx_15.c b/lib/dns/rdata/generic/mx_15.c
index 474fae44096..a1eb04ceeb9 100644
--- a/lib/dns/rdata/generic/mx_15.c
+++ b/lib/dns/rdata/generic/mx_15.c
@@ -278,7 +278,7 @@ additionaldata_mx(ARGS_ADDLDATA) {
 	isc_region_consume(&region, 2);
 	dns_name_fromregion(&name, &region);
 
-	if (dns_name_equal(&name, dns_rootname)) {
+	if (dns_name_isroot(&name)) {
 		return ISC_R_SUCCESS;
 	}
 
diff --git a/lib/dns/rdata/generic/opt_41.c b/lib/dns/rdata/generic/opt_41.c
index d9513b75fd4..7602c713759 100644
--- a/lib/dns/rdata/generic/opt_41.c
+++ b/lib/dns/rdata/generic/opt_41.c
@@ -427,7 +427,7 @@ checkowner_opt(ARGS_CHECKOWNER) {
 	UNUSED(rdclass);
 	UNUSED(wildcard);
 
-	return dns_name_equal(name, dns_rootname);
+	return dns_name_isroot(name);
 }
 
 static bool
diff --git a/lib/dns/rdata/in_1/srv_33.c b/lib/dns/rdata/in_1/srv_33.c
index 755a8751800..73de8072688 100644
--- a/lib/dns/rdata/in_1/srv_33.c
+++ b/lib/dns/rdata/in_1/srv_33.c
@@ -324,7 +324,7 @@ additionaldata_in_srv(ARGS_ADDLDATA) {
 	isc_region_consume(&region, 2);
 	dns_name_fromregion(&name, &region);
 
-	if (dns_name_equal(&name, dns_rootname)) {
+	if (dns_name_isroot(&name)) {
 		return ISC_R_SUCCESS;
 	}
 
diff --git a/lib/dns/rdata/in_1/svcb_64.c b/lib/dns/rdata/in_1/svcb_64.c
index 04f41ec268c..2e8916e6f18 100644
--- a/lib/dns/rdata/in_1/svcb_64.c
+++ b/lib/dns/rdata/in_1/svcb_64.c
@@ -1095,11 +1095,11 @@ generic_additionaldata_in_svcb(ARGS_ADDLDATA) {
 
 	dns_name_fromregion(&name, &region);
 
-	if (dns_name_equal(&name, dns_rootname)) {
+	if (dns_name_isroot(&name)) {
 		/*
 		 * "." only means owner name in service form.
 		 */
-		if (alias || dns_name_equal(owner, dns_rootname) ||
+		if (alias || dns_name_isroot(owner) ||
 		    !dns_name_ishostname(owner, false))
 		{
 			return ISC_R_SUCCESS;
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 57b26e68645..6199c87906b 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -3564,7 +3564,7 @@ fctx_getaddresses_forwarders(fetchctx_t *fctx) {
 		 * Strip label to get the correct forwarder (if any).
 		 */
 		if (dns_rdatatype_atparent(fctx->type) &&
-		    dns_name_countlabels(name) > 1)
+		    dns_name_belowroot(name))
 		{
 			unsigned int labels;
 			dns_name_init(&suffix);
@@ -5057,7 +5057,7 @@ fctx__create(dns_resolver_t *res, isc_loop_t *loop, const dns_name_t *name,
 		 * the forwarder).
 		 */
 		if (dns_rdatatype_atparent(fctx->type) &&
-		    dns_name_countlabels(name) > 1)
+		    dns_name_belowroot(name))
 		{
 			dns_name_init(&suffix);
 			labels = dns_name_countlabels(name);
@@ -8756,7 +8756,7 @@ rctx_answer_positive(respctx_t *rctx) {
 
 	if (rctx->ns_rdataset != NULL &&
 	    dns_name_equal(fctx->domain, rctx->ns_name) &&
-	    !dns_name_equal(rctx->ns_name, dns_rootname))
+	    !dns_name_isroot(rctx->ns_name))
 	{
 		trim_ns_ttl(fctx, rctx->ns_name, rctx->ns_rdataset);
 	}
@@ -9190,7 +9190,7 @@ rctx_answer_none(respctx_t *rctx) {
 
 	if (rctx->ns_rdataset != NULL &&
 	    dns_name_equal(fctx->domain, rctx->ns_name) &&
-	    !dns_name_equal(rctx->ns_name, dns_rootname))
+	    !dns_name_isroot(rctx->ns_name))
 	{
 		trim_ns_ttl(fctx, rctx->ns_name, rctx->ns_rdataset);
 	}
@@ -9221,7 +9221,7 @@ rctx_answer_none(respctx_t *rctx) {
 	    rctx->query->rmessage->rcode == dns_rcode_noerror &&
 	    fctx->type == dns_rdatatype_ds && rctx->soa_name != NULL &&
 	    dns_name_equal(rctx->soa_name, fctx->name) &&
-	    !dns_name_equal(fctx->name, dns_rootname))
+	    !dns_name_isroot(fctx->name))
 	{
 		return DNS_R_CHASEDSSERVERS;
 	}
@@ -9532,7 +9532,7 @@ rctx_referral(respctx_t *rctx) {
 	 * namespace checks, even if their address info uses the forwarder flag.
 	 */
 	if (ISFORWARDER(fctx->addrinfo) && !ISDUALSTACK(fctx->addrinfo) &&
-	    dns_name_equal(fctx->fwdname, dns_rootname))
+	    dns_name_isroot(fctx->fwdname))
 	{
 		log_formerr(fctx, "referral from global forwarder");
 		rctx->result = DNS_R_FORMERR;
diff --git a/lib/dns/rootns.c b/lib/dns/rootns.c
index 10004af2484..7d40a006296 100644
--- a/lib/dns/rootns.c
+++ b/lib/dns/rootns.c
@@ -163,7 +163,7 @@ check_node(dns_rdataset_t *rootns, dns_name_t *name,
 		case dns_rdatatype_aaaa:
 			return in_rootns(rootns, name);
 		case dns_rdatatype_ns:
-			if (dns_name_compare(name, dns_rootname) == 0) {
+			if (dns_name_isroot(name)) {
 				return ISC_R_SUCCESS;
 			}
 			FALLTHROUGH;
diff --git a/lib/dns/rpz.c b/lib/dns/rpz.c
index d1e3846a3ed..b7cff897338 100644
--- a/lib/dns/rpz.c
+++ b/lib/dns/rpz.c
@@ -2698,7 +2698,7 @@ dns_rpz_decode_cname(dns_rpz_zone_t *rpz, dns_rdataset_t *rdataset,
 	/*
 	 * CNAME . means NXDOMAIN
 	 */
-	if (dns_name_equal(&cname.cname, dns_rootname)) {
+	if (dns_name_isroot(&cname.cname)) {
 		return DNS_RPZ_POLICY_NXDOMAIN;
 	}
 
diff --git a/lib/dns/tkey.c b/lib/dns/tkey.c
index 7a3e0f6b0b0..86532cfafe2 100644
--- a/lib/dns/tkey.c
+++ b/lib/dns/tkey.c
@@ -406,7 +406,7 @@ dns_tkey_processquery(dns_message_t *msg, dns_tkeyctx_t *tctx,
 	case DNS_TKEYMODE_GSSAPI:
 		keyname = dns_fixedname_initname(&fkeyname);
 
-		if (!dns_name_equal(qname, dns_rootname)) {
+		if (!dns_name_isroot(qname)) {
 			unsigned int n = dns_name_countlabels(qname);
 			dns_name_copy(qname, keyname);
 			dns_name_getlabelsequence(keyname, 0, n - 1, keyname);
diff --git a/lib/dns/validator.c b/lib/dns/validator.c
index 8a98f59eefe..f4cc2254ed8 100644
--- a/lib/dns/validator.c
+++ b/lib/dns/validator.c
@@ -2636,7 +2636,7 @@ validate_dnskey(void *arg) {
 		 * If this is the root name and there was no trust anchor,
 		 * we can give up now, since there's no DS at the root.
 		 */
-		if (dns_name_equal(val->name, dns_rootname)) {
+		if (dns_name_isroot(val->name)) {
 			if ((val->attributes & VALATTR_TRIEDVERIFY) != 0) {
 				validator_log(val, ISC_LOG_DEBUG(3),
 					      "root key failed to validate");
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index ac21cf5ac3f..557c316b08d 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -1799,7 +1799,7 @@ zone_check_mx(dns_zone_t *zone, dns_db_t *db, dns_name_t *name,
 	/*
 	 * "." means the services does not exist.
 	 */
-	if (dns_name_equal(name, dns_rootname)) {
+	if (dns_name_isroot(name)) {
 		return true;
 	}
 
@@ -1900,7 +1900,7 @@ zone_check_srv(dns_zone_t *zone, dns_db_t *db, dns_name_t *name,
 	/*
 	 * "." means the services does not exist.
 	 */
-	if (dns_name_equal(name, dns_rootname)) {
+	if (dns_name_isroot(name)) {
 		return true;
 	}
 
@@ -17806,7 +17806,7 @@ nsfetch_start(dns_zonefetch_t *fetch) {
 	nsfetch = &fetch->fetchdata.nsfetch;
 
 	/* Derive parent domain. Check for root domain. */
-	if (dns_name_countlabels(&nsfetch->pname) <= 1U) {
+	if (!dns_name_belowroot(&nsfetch->pname)) {
 		return ISC_R_NOTFOUND;
 	}
 
diff --git a/lib/isccfg/check.c b/lib/isccfg/check.c
index 5c85f426e02..a505d3c244a 100644
--- a/lib/isccfg/check.c
+++ b/lib/isccfg/check.c
@@ -2748,7 +2748,7 @@ check_update_policy(const cfg_obj_t *policy) {
 		case dns_ssumatchtype_selfwild:
 			if (tresult == ISC_R_SUCCESS &&
 			    (!dns_name_equal(id, name) &&
-			     !dns_name_equal(dns_rootname, name)))
+			     !dns_name_isroot(name)))
 			{
 				cfg_obj_log(identity, ISC_LOG_ERROR,
 					    "identity and name fields are not "
@@ -2762,8 +2762,7 @@ check_update_policy(const cfg_obj_t *policy) {
 		case dns_ssumatchtype_selfsubms:
 		case dns_ssumatchtype_tcpself:
 		case dns_ssumatchtype_6to4self:
-			if (tresult == ISC_R_SUCCESS &&
-			    !dns_name_equal(dns_rootname, name))
+			if (tresult == ISC_R_SUCCESS && !dns_name_isroot(name))
 			{
 				cfg_obj_log(identity, ISC_LOG_ERROR,
 					    "name field not set to "
@@ -3492,7 +3491,7 @@ isccfg_check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		if (tresult != ISC_R_SUCCESS) {
 			result = tresult;
 		}
-		if (dns_name_equal(zname, dns_rootname)) {
+		if (dns_name_isroot(zname)) {
 			root = true;
 		} else if (dns_name_isrfc1918(zname)) {
 			rfc1918 = true;
@@ -3809,7 +3808,7 @@ isccfg_check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 	 */
 	if (ztype == CFG_ZONE_SECONDARY || ztype == CFG_ZONE_STUB ||
 	    (ztype == CFG_ZONE_MIRROR && zname != NULL &&
-	     !dns_name_equal(zname, dns_rootname)))
+	     !dns_name_isroot(zname)))
 	{
 		obj = NULL;
 		(void)get_zoneopt(zoptions, toptions, NULL, NULL, "primaries",
@@ -4185,7 +4184,7 @@ isccfg_check_zoneconf(const cfg_obj_t *zconfig, const cfg_obj_t *voptions,
 		(void)get_zoneopt(zoptions, toptions, NULL, NULL,
 				  "log-report-channel", &obj);
 		if (obj != NULL && cfg_obj_asboolean(obj) &&
-		    dns_name_equal(zname, dns_rootname))
+		    dns_name_isroot(zname))
 		{
 			cfg_obj_log(zconfig, ISC_LOG_ERROR,
 				    "'log-report-channel' cannot be set in "
@@ -5100,9 +5099,7 @@ check_trust_anchor(const cfg_obj_t *key, unsigned int *flagsp) {
 			}
 		}
 
-		if (result == ISC_R_SUCCESS &&
-		    dns_name_equal(keyname, dns_rootname))
-		{
+		if (result == ISC_R_SUCCESS && dns_name_isroot(keyname)) {
 			/*
 			 * Flag any use of a root key, regardless of content.
 			 */
@@ -5157,9 +5154,7 @@ check_trust_anchor(const cfg_obj_t *key, unsigned int *flagsp) {
 				    isc_result_totext(tresult));
 			result = ISC_R_FAILURE;
 		}
-		if (result == ISC_R_SUCCESS &&
-		    dns_name_equal(keyname, dns_rootname))
-		{
+		if (result == ISC_R_SUCCESS && dns_name_isroot(keyname)) {
 			/*
 			 * Flag any use of a root key, regardless of content.
 			 */
@@ -5242,7 +5237,7 @@ record_static_keys(isc_symtab_t *symtab, isc_mem_t *mctx,
 			isc_mem_free(mctx, p);
 		}
 
-		if (autovalidation && dns_name_equal(name, dns_rootname)) {
+		if (autovalidation && dns_name_isroot(name)) {
 			cfg_obj_log(obj, ISC_LOG_ERROR,
 				    "static trust anchor for root zone "
 				    "cannot be used with "
diff --git a/lib/ns/client.c b/lib/ns/client.c
index cf8a401e712..fd17f88a940 100644
--- a/lib/ns/client.c
+++ b/lib/ns/client.c
@@ -1207,7 +1207,7 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message) {
 		if (dns_name_dynamic(&client->inner.rad)) {
 			rad = &client->inner.rad;
 		}
-		if (rad != NULL && !dns_name_equal(rad, dns_rootname)) {
+		if (rad != NULL && !dns_name_isroot(rad)) {
 			dns_ednsopt_t option = {
 				.code = DNS_OPT_REPORT_CHANNEL,
 				.length = rad->length,
diff --git a/lib/ns/query.c b/lib/ns/query.c
index f9e662d25d6..65c92f5371e 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -3990,7 +3990,7 @@ rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype, isc_result_t qresult,
 			/*
 			 * Do nothing about "NS ."
 			 */
-			if (dns_name_equal(&ns.name, dns_rootname)) {
+			if (dns_name_isroot(&ns.name)) {
 				dns_rdata_freestruct(&ns);
 				result = dns_rdataset_next(st->r.ns_rdataset);
 				continue;
@@ -5135,7 +5135,7 @@ ns__query_start(query_ctx_t *qctx) {
 	 */
 	qctx->options = (dns_getdb_options_t){ .nolog = qctx->options.nolog };
 	if (dns_rdatatype_atparent(qctx->qtype) &&
-	    !dns_name_equal(qctx->client->query.qname, dns_rootname))
+	    !dns_name_isroot(qctx->client->query.qname))
 	{
 		/*
 		 * If authoritative data for this QTYPE is supposed to live in
@@ -7133,7 +7133,7 @@ query_gotanswer(query_ctx_t *qctx, isc_result_t result) {
 		return ns_query_done(qctx);
 	}
 
-	if (!dns_name_equal(qctx->client->query.qname, dns_rootname)) {
+	if (!dns_name_isroot(qctx->client->query.qname)) {
 		result = query_checkrpz(qctx, result);
 		if (result == ISC_R_NOTFOUND) {
 			/*
@@ -7774,7 +7774,7 @@ query_respond(query_ctx_t *qctx) {
 		 * Always add glue for root priming queries, regardless
 		 * of "minimal-responses" setting.
 		 */
-		if (dns_name_equal(qctx->client->query.qname, dns_rootname)) {
+		if (dns_name_isroot(qctx->client->query.qname)) {
 			qctx->client->query.noadditional = false;
 			dns_db_attach(qctx->db, &qctx->client->query.gluedb);
 		}