diff --git a/lib/ns/client.c b/lib/ns/client.c
index ca75b23925..2cd191dd21 100644
--- a/lib/ns/client.c
+++ b/lib/ns/client.c
@@ -152,7 +152,7 @@ ns_client_killoldestquery(ns_client_t *client) {
 	if (oldest != NULL) {
 		ISC_LIST_UNLINK(client->manager->recursing, oldest, rlink);
 		ns_query_cancel(oldest);
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_reclimitdropped);
 	}
 	UNLOCK(&client->manager->reclock);
@@ -170,8 +170,9 @@ client_extendederror_reset(ns_client_t *client) {
 	if (client->ede == NULL) {
 		return;
 	}
-	isc_mem_put(client->mctx, client->ede->value, client->ede->length);
-	isc_mem_put(client->mctx, client->ede, sizeof(dns_ednsopt_t));
+	isc_mem_put(client->manager->mctx, client->ede->value,
+		    client->ede->length);
+	isc_mem_put(client->manager->mctx, client->ede, sizeof(dns_ednsopt_t));
 	client->ede = NULL;
 }
 
@@ -208,10 +209,10 @@ ns_client_extendederror(ns_client_t *client, uint16_t code, const char *text) {
 		}
 	}
 
-	client->ede = isc_mem_get(client->mctx, sizeof(dns_ednsopt_t));
+	client->ede = isc_mem_get(client->manager->mctx, sizeof(dns_ednsopt_t));
 	client->ede->code = DNS_OPT_EDE;
 	client->ede->length = len;
-	client->ede->value = isc_mem_get(client->mctx, len);
+	client->ede->value = isc_mem_get(client->manager->mctx, len);
 	memmove(client->ede->value, ede, len);
 };
 
@@ -239,7 +240,7 @@ ns_client_endrequest(ns_client_t *client) {
 
 	if (client->view != NULL) {
 #ifdef ENABLE_AFL
-		if (client->sctx->fuzztype == isc_fuzz_resolver) {
+		if (client->manager->sctx->fuzztype == isc_fuzz_resolver) {
 			dns_cache_clean(client->view->cache, INT_MAX);
 			dns_adb_flush(client->view->adb);
 		}
@@ -269,7 +270,7 @@ ns_client_endrequest(ns_client_t *client) {
 	if (client->recursionquota != NULL) {
 		isc_quota_detach(&client->recursionquota);
 		if (client->query.prefetch == NULL) {
-			ns_stats_decrement(client->sctx->nsstats,
+			ns_stats_decrement(client->manager->sctx->nsstats,
 					   ns_statscounter_recursclients);
 		}
 	}
@@ -279,12 +280,12 @@ ns_client_endrequest(ns_client_t *client) {
 	 */
 	client->attributes = 0;
 #ifdef ENABLE_AFL
-	if (client->sctx->fuzznotify != NULL &&
-	    (client->sctx->fuzztype == isc_fuzz_client ||
-	     client->sctx->fuzztype == isc_fuzz_tcpclient ||
-	     client->sctx->fuzztype == isc_fuzz_resolver))
+	if (client->manager->sctx->fuzznotify != NULL &&
+	    (client->manager->sctx->fuzztype == isc_fuzz_client ||
+	     client->manager->sctx->fuzztype == isc_fuzz_tcpclient ||
+	     client->manager->sctx->fuzztype == isc_fuzz_resolver))
 	{
-		client->sctx->fuzznotify();
+		client->manager->sctx->fuzznotify();
 	}
 #endif /* ENABLE_AFL */
 }
@@ -349,7 +350,7 @@ client_allocsendbuf(ns_client_t *client, isc_buffer_t *buffer,
 
 	if (TCP_CLIENT(client)) {
 		INSIST(client->tcpbuf == NULL);
-		client->tcpbuf = isc_mem_get(client->mctx,
+		client->tcpbuf = isc_mem_get(client->manager->mctx,
 					     NS_CLIENT_TCP_BUFFER_SIZE);
 		data = client->tcpbuf;
 		isc_buffer_init(buffer, data, NS_CLIENT_TCP_BUFFER_SIZE);
@@ -453,7 +454,7 @@ ns_client_sendraw(ns_client_t *client, dns_message_t *message) {
 	return;
 done:
 	if (client->tcpbuf != NULL) {
-		isc_mem_put(client->mctx, client->tcpbuf,
+		isc_mem_put(client->manager->mctx, client->tcpbuf,
 			    NS_CLIENT_TCP_BUFFER_SIZE);
 		client->tcpbuf = NULL;
 	}
@@ -536,7 +537,7 @@ ns_client_send(ns_client_t *client) {
 
 	client_allocsendbuf(client, &buffer, &data);
 
-	result = dns_compress_init(&cctx, -1, client->mctx);
+	result = dns_compress_init(&cctx, -1, client->manager->mctx);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -670,11 +671,11 @@ renderend:
 
 		switch (isc_sockaddr_pf(&client->peeraddr)) {
 		case AF_INET:
-			isc_stats_increment(client->sctx->tcpoutstats4,
+			isc_stats_increment(client->manager->sctx->tcpoutstats4,
 					    ISC_MIN((int)respsize / 16, 256));
 			break;
 		case AF_INET6:
-			isc_stats_increment(client->sctx->tcpoutstats6,
+			isc_stats_increment(client->manager->sctx->tcpoutstats6,
 					    ISC_MIN((int)respsize / 16, 256));
 			break;
 		default:
@@ -699,11 +700,11 @@ renderend:
 
 		switch (isc_sockaddr_pf(&client->peeraddr)) {
 		case AF_INET:
-			isc_stats_increment(client->sctx->udpoutstats4,
+			isc_stats_increment(client->manager->sctx->udpoutstats4,
 					    ISC_MIN((int)respsize / 16, 256));
 			break;
 		case AF_INET6:
-			isc_stats_increment(client->sctx->udpoutstats6,
+			isc_stats_increment(client->manager->sctx->udpoutstats6,
 					    ISC_MIN((int)respsize / 16, 256));
 			break;
 		default:
@@ -712,24 +713,25 @@ renderend:
 	}
 
 	/* update statistics (XXXJT: is it okay to access message->xxxkey?) */
-	ns_stats_increment(client->sctx->nsstats, ns_statscounter_response);
+	ns_stats_increment(client->manager->sctx->nsstats,
+			   ns_statscounter_response);
 
-	dns_rcodestats_increment(client->sctx->rcodestats,
+	dns_rcodestats_increment(client->manager->sctx->rcodestats,
 				 client->message->rcode);
 	if (opt_included) {
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_edns0out);
 	}
 	if (client->message->tsigkey != NULL) {
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_tsigout);
 	}
 	if (client->message->sig0key != NULL) {
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_sig0out);
 	}
 	if ((client->message->flags & DNS_MESSAGEFLAG_TC) != 0) {
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_truncatedresp);
 	}
 
@@ -739,7 +741,7 @@ renderend:
 
 cleanup:
 	if (client->tcpbuf != NULL) {
-		isc_mem_put(client->mctx, client->tcpbuf,
+		isc_mem_put(client->manager->mctx, client->tcpbuf,
 			    NS_CLIENT_TCP_BUFFER_SIZE);
 		client->tcpbuf = NULL;
 	}
@@ -832,7 +834,8 @@ ns_client_error(ns_client_t *client, isc_result_t result) {
 		dns_rrl_result_t rrl_result;
 		int loglevel;
 
-		if ((client->sctx->options & NS_SERVER_LOGQUERIES) != 0) {
+		if ((client->manager->sctx->options & NS_SERVER_LOGQUERIES) !=
+		    0) {
 			loglevel = DNS_RRL_LOG_DROP;
 		} else {
 			loglevel = ISC_LOG_DEBUG(1);
@@ -860,10 +863,12 @@ ns_client_error(ns_client_t *client, isc_result_t result) {
 			 * so don't try to slip any error responses.
 			 */
 			if (!client->view->rrl->log_only) {
-				ns_stats_increment(client->sctx->nsstats,
-						   ns_statscounter_ratedropped);
-				ns_stats_increment(client->sctx->nsstats,
-						   ns_statscounter_dropped);
+				ns_stats_increment(
+					client->manager->sctx->nsstats,
+					ns_statscounter_ratedropped);
+				ns_stats_increment(
+					client->manager->sctx->nsstats,
+					ns_statscounter_dropped);
 				ns_client_drop(client, DNS_R_DROP);
 				return;
 			}
@@ -981,17 +986,18 @@ ns_client_addopt(ns_client_t *client, dns_message_t *message,
 	if (resolver != NULL) {
 		udpsize = dns_resolver_getudpsize(resolver);
 	} else {
-		udpsize = client->sctx->udpsize;
+		udpsize = client->manager->sctx->udpsize;
 	}
 
 	flags = client->extflags & DNS_MESSAGEEXTFLAG_REPLYPRESERVE;
 
 	/* Set EDNS options if applicable */
 	if (WANTNSID(client)) {
-		if (client->sctx->server_id != NULL) {
-			nsidp = client->sctx->server_id;
-		} else if (client->sctx->gethostname != NULL) {
-			result = client->sctx->gethostname(nsid, sizeof(nsid));
+		if (client->manager->sctx->server_id != NULL) {
+			nsidp = client->manager->sctx->server_id;
+		} else if (client->manager->sctx->gethostname != NULL) {
+			result = client->manager->sctx->gethostname(
+				nsid, sizeof(nsid));
 			if (result != ISC_R_SUCCESS) {
 				goto no_nsid;
 			}
@@ -1017,7 +1023,8 @@ no_nsid:
 
 		isc_random_buf(&nonce, sizeof(nonce));
 
-		compute_cookie(client, now, nonce, client->sctx->secret, &buf);
+		compute_cookie(client, now, nonce,
+			       client->manager->sctx->secret, &buf);
 
 		INSIST(count < DNS_EDNSOPTIONS);
 		ednsopts[count].code = DNS_OPT_COOKIE;
@@ -1162,7 +1169,7 @@ compute_cookie(ns_client_t *client, uint32_t when, uint32_t nonce,
 							       "digest "
 							       "buffer.");
 
-	switch (client->sctx->cookiealg) {
+	switch (client->manager->sctx->cookiealg) {
 	case ns_cookiealg_siphash24: {
 		unsigned char input[16 + 16] ISC_NONSTRING = { 0 };
 		size_t inputlen = 0;
@@ -1227,8 +1234,8 @@ compute_cookie(ns_client_t *client, uint32_t when, uint32_t nonce,
 			for (i = 0; i < 8; i++) {
 				input[i + 8] = digest[i] ^ digest[i + 8];
 			}
-			isc_aes128_crypt(client->sctx->secret, input + 8,
-					 digest);
+			isc_aes128_crypt(client->manager->sctx->secret,
+					 input + 8, digest);
 			break;
 		default:
 			UNREACHABLE();
@@ -1258,7 +1265,7 @@ process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
 	/*
 	 * If we have already seen a cookie option skip this cookie option.
 	 */
-	if ((!client->sctx->answercookie) ||
+	if ((!client->manager->sctx->answercookie) ||
 	    (client->attributes & NS_CLIENTATTR_WANTCOOKIE) != 0)
 	{
 		isc_buffer_forward(buf, (unsigned int)optlen);
@@ -1267,7 +1274,8 @@ process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
 
 	client->attributes |= NS_CLIENTATTR_WANTCOOKIE;
 
-	ns_stats_increment(client->sctx->nsstats, ns_statscounter_cookiein);
+	ns_stats_increment(client->manager->sctx->nsstats,
+			   ns_statscounter_cookiein);
 
 	if (optlen != COOKIE_SIZE) {
 		/*
@@ -1278,10 +1286,10 @@ process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
 		isc_buffer_forward(buf, (unsigned int)optlen);
 
 		if (optlen == 8U) {
-			ns_stats_increment(client->sctx->nsstats,
+			ns_stats_increment(client->manager->sctx->nsstats,
 					   ns_statscounter_cookienew);
 		} else {
-			ns_stats_increment(client->sctx->nsstats,
+			ns_stats_increment(client->manager->sctx->nsstats,
 					   ns_statscounter_cookiebadsize);
 		}
 		return;
@@ -1305,35 +1313,35 @@ process_cookie(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
 	if (isc_serial_gt(when, (now + 300)) || /* In the future. */
 	    isc_serial_lt(when, (now - 3600)))
 	{ /* In the past. */
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_cookiebadtime);
 		return;
 	}
 
 	isc_buffer_init(&db, dbuf, sizeof(dbuf));
-	compute_cookie(client, when, nonce, client->sctx->secret, &db);
+	compute_cookie(client, when, nonce, client->manager->sctx->secret, &db);
 
 	if (isc_safe_memequal(old, dbuf, COOKIE_SIZE)) {
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_cookiematch);
 		client->attributes |= NS_CLIENTATTR_HAVECOOKIE;
 		return;
 	}
 
-	for (altsecret = ISC_LIST_HEAD(client->sctx->altsecrets);
+	for (altsecret = ISC_LIST_HEAD(client->manager->sctx->altsecrets);
 	     altsecret != NULL; altsecret = ISC_LIST_NEXT(altsecret, link))
 	{
 		isc_buffer_init(&db, dbuf, sizeof(dbuf));
 		compute_cookie(client, when, nonce, altsecret->secret, &db);
 		if (isc_safe_memequal(old, dbuf, COOKIE_SIZE)) {
-			ns_stats_increment(client->sctx->nsstats,
+			ns_stats_increment(client->manager->sctx->nsstats,
 					   ns_statscounter_cookiematch);
 			client->attributes |= NS_CLIENTATTR_HAVECOOKIE;
 			return;
 		}
 	}
 
-	ns_stats_increment(client->sctx->nsstats,
+	ns_stats_increment(client->manager->sctx->nsstats,
 			   ns_statscounter_cookienomatch);
 }
 
@@ -1469,7 +1477,7 @@ process_keytag(ns_client_t *client, isc_buffer_t *buf, size_t optlen) {
 		return (ISC_R_SUCCESS);
 	}
 
-	client->keytag = isc_mem_get(client->mctx, optlen);
+	client->keytag = isc_mem_get(client->manager->mctx, optlen);
 	{
 		client->keytag_len = (uint16_t)optlen;
 		memmove(client->keytag, isc_buffer_current(buf), optlen);
@@ -1511,7 +1519,7 @@ process_opt(ns_client_t *client, dns_rdataset_t *opt) {
 	 */
 	client->ednsversion = (opt->ttl & 0x00FF0000) >> 16;
 	if (client->ednsversion > DNS_EDNS_VERSION) {
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_badednsver);
 		result = ns_client_addopt(client, client->message,
 					  &client->opt);
@@ -1536,7 +1544,7 @@ process_opt(ns_client_t *client, dns_rdataset_t *opt) {
 			case DNS_OPT_NSID:
 				if (!WANTNSID(client)) {
 					ns_stats_increment(
-						client->sctx->nsstats,
+						client->manager->sctx->nsstats,
 						ns_statscounter_nsidopt);
 				}
 				client->attributes |= NS_CLIENTATTR_WANTNSID;
@@ -1548,7 +1556,7 @@ process_opt(ns_client_t *client, dns_rdataset_t *opt) {
 			case DNS_OPT_EXPIRE:
 				if (!WANTEXPIRE(client)) {
 					ns_stats_increment(
-						client->sctx->nsstats,
+						client->manager->sctx->nsstats,
 						ns_statscounter_expireopt);
 				}
 				client->attributes |= NS_CLIENTATTR_WANTEXPIRE;
@@ -1560,13 +1568,14 @@ process_opt(ns_client_t *client, dns_rdataset_t *opt) {
 					ns_client_error(client, result);
 					return (result);
 				}
-				ns_stats_increment(client->sctx->nsstats,
-						   ns_statscounter_ecsopt);
+				ns_stats_increment(
+					client->manager->sctx->nsstats,
+					ns_statscounter_ecsopt);
 				break;
 			case DNS_OPT_TCP_KEEPALIVE:
 				if (!USEKEEPALIVE(client)) {
 					ns_stats_increment(
-						client->sctx->nsstats,
+						client->manager->sctx->nsstats,
 						ns_statscounter_keepaliveopt);
 				}
 				client->attributes |=
@@ -1576,8 +1585,9 @@ process_opt(ns_client_t *client, dns_rdataset_t *opt) {
 				break;
 			case DNS_OPT_PAD:
 				client->attributes |= NS_CLIENTATTR_WANTPAD;
-				ns_stats_increment(client->sctx->nsstats,
-						   ns_statscounter_padopt);
+				ns_stats_increment(
+					client->manager->sctx->nsstats,
+					ns_statscounter_padopt);
 				isc_buffer_forward(&optbuf, optlen);
 				break;
 			case DNS_OPT_KEY_TAG:
@@ -1587,19 +1597,22 @@ process_opt(ns_client_t *client, dns_rdataset_t *opt) {
 					ns_client_error(client, result);
 					return (result);
 				}
-				ns_stats_increment(client->sctx->nsstats,
-						   ns_statscounter_keytagopt);
+				ns_stats_increment(
+					client->manager->sctx->nsstats,
+					ns_statscounter_keytagopt);
 				break;
 			default:
-				ns_stats_increment(client->sctx->nsstats,
-						   ns_statscounter_otheropt);
+				ns_stats_increment(
+					client->manager->sctx->nsstats,
+					ns_statscounter_otheropt);
 				isc_buffer_forward(&optbuf, optlen);
 				break;
 			}
 		}
 	}
 
-	ns_stats_increment(client->sctx->nsstats, ns_statscounter_edns0in);
+	ns_stats_increment(client->manager->sctx->nsstats,
+			   ns_statscounter_edns0in);
 	client->attributes |= NS_CLIENTATTR_WANTOPT;
 
 	return (result);
@@ -1622,12 +1635,13 @@ ns__client_reset_cb(void *client0) {
 
 	ns_client_endrequest(client);
 	if (client->tcpbuf != NULL) {
-		isc_mem_put(client->mctx, client->tcpbuf,
+		isc_mem_put(client->manager->mctx, client->tcpbuf,
 			    NS_CLIENT_TCP_BUFFER_SIZE);
 	}
 
 	if (client->keytag != NULL) {
-		isc_mem_put(client->mctx, client->keytag, client->keytag_len);
+		isc_mem_put(client->manager->mctx, client->keytag,
+			    client->keytag_len);
 		client->keytag_len = 0;
 	}
 
@@ -1654,7 +1668,8 @@ ns__client_put_cb(void *client0) {
 	client->magic = 0;
 	client->shuttingdown = true;
 
-	isc_mem_put(client->mctx, client->sendbuf, NS_CLIENT_SEND_BUFFER_SIZE);
+	isc_mem_put(client->manager->mctx, client->sendbuf,
+		    NS_CLIENT_SEND_BUFFER_SIZE);
 	if (client->opt != NULL) {
 		INSIST(dns_rdataset_isassociated(client->opt));
 		dns_rdataset_disassociate(client->opt);
@@ -1668,26 +1683,11 @@ ns__client_put_cb(void *client0) {
 		clientmgr_detach(&client->manager);
 	}
 
-	/*
-	 * Detaching the task must be done after unlinking from
-	 * the manager's lists because the manager accesses
-	 * client->task.
-	 */
-	if (client->task != NULL) {
-		isc_task_detach(&client->task);
-	}
-
 	/*
 	 * Destroy the fetchlock mutex that was created in
 	 * ns_query_init().
 	 */
 	isc_mutex_destroy(&client->query.fetchlock);
-
-	if (client->sctx != NULL) {
-		ns_server_detach(&client->sctx);
-	}
-
-	isc_mem_detach(&client->mctx);
 }
 
 /*
@@ -1794,9 +1794,9 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 #endif /* if NS_CLIENT_DROPPORT */
 
 	env = client->manager->aclenv;
-	if (client->sctx->blackholeacl != NULL &&
-	    (dns_acl_match(&netaddr, NULL, client->sctx->blackholeacl, env,
-			   &match, NULL) == ISC_R_SUCCESS) &&
+	if (client->manager->sctx->blackholeacl != NULL &&
+	    (dns_acl_match(&netaddr, NULL, client->manager->sctx->blackholeacl,
+			   env, &match, NULL) == ISC_R_SUCCESS) &&
 	    match > 0)
 	{
 		ns_client_log(client, DNS_LOGCATEGORY_SECURITY,
@@ -1846,22 +1846,22 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 	 * Update some statistics counters.  Don't count responses.
 	 */
 	if (isc_sockaddr_pf(&client->peeraddr) == PF_INET) {
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_requestv4);
 	} else {
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_requestv6);
 	}
 	if (TCP_CLIENT(client)) {
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_requesttcp);
 		switch (isc_sockaddr_pf(&client->peeraddr)) {
 		case AF_INET:
-			isc_stats_increment(client->sctx->tcpinstats4,
+			isc_stats_increment(client->manager->sctx->tcpinstats4,
 					    ISC_MIN((int)reqsize / 16, 18));
 			break;
 		case AF_INET6:
-			isc_stats_increment(client->sctx->tcpinstats6,
+			isc_stats_increment(client->manager->sctx->tcpinstats6,
 					    ISC_MIN((int)reqsize / 16, 18));
 			break;
 		default:
@@ -1870,11 +1870,11 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 	} else {
 		switch (isc_sockaddr_pf(&client->peeraddr)) {
 		case AF_INET:
-			isc_stats_increment(client->sctx->udpinstats4,
+			isc_stats_increment(client->manager->sctx->udpinstats4,
 					    ISC_MIN((int)reqsize / 16, 18));
 			break;
 		case AF_INET6:
-			isc_stats_increment(client->sctx->udpinstats6,
+			isc_stats_increment(client->manager->sctx->udpinstats6,
 					    ISC_MIN((int)reqsize / 16, 18));
 			break;
 		default:
@@ -1907,7 +1907,7 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		return;
 	}
 
-	dns_opcodestats_increment(client->sctx->opcodestats,
+	dns_opcodestats_increment(client->manager->sctx->opcodestats,
 				  client->message->opcode);
 	switch (client->message->opcode) {
 	case dns_opcode_query:
@@ -1927,7 +1927,7 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 	/*
 	 * Deal with EDNS.
 	 */
-	if ((client->sctx->options & NS_SERVER_NOEDNS) != 0) {
+	if ((client->manager->sctx->options & NS_SERVER_NOEDNS) != 0) {
 		opt = NULL;
 	} else {
 		opt = dns_message_getopt(client->message);
@@ -1941,7 +1941,8 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		 * Are returning FORMERR to all EDNS queries?
 		 * Simulate a STD13 compliant server.
 		 */
-		if ((client->sctx->options & NS_SERVER_EDNSFORMERR) != 0) {
+		if ((client->manager->sctx->options & NS_SERVER_EDNSFORMERR) !=
+		    0) {
 			ns_client_error(client, DNS_R_FORMERR);
 			return;
 		}
@@ -1949,7 +1950,8 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		/*
 		 * Are returning NOTIMP to all EDNS queries?
 		 */
-		if ((client->sctx->options & NS_SERVER_EDNSNOTIMP) != 0) {
+		if ((client->manager->sctx->options & NS_SERVER_EDNSNOTIMP) !=
+		    0) {
 			ns_client_error(client, DNS_R_NOTIMP);
 			return;
 		}
@@ -1957,7 +1959,8 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		/*
 		 * Are returning REFUSED to all EDNS queries?
 		 */
-		if ((client->sctx->options & NS_SERVER_EDNSREFUSED) != 0) {
+		if ((client->manager->sctx->options & NS_SERVER_EDNSREFUSED) !=
+		    0) {
 			ns_client_error(client, DNS_R_REFUSED);
 			return;
 		}
@@ -1965,7 +1968,8 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		/*
 		 * Are we dropping all EDNS queries?
 		 */
-		if ((client->sctx->options & NS_SERVER_DROPEDNS) != 0) {
+		if ((client->manager->sctx->options & NS_SERVER_DROPEDNS) != 0)
+		{
 			ns_client_drop(client, ISC_R_SUCCESS);
 			return;
 		}
@@ -2009,9 +2013,9 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 
 	isc_sockaddr_fromnetaddr(&client->destsockaddr, &client->destaddr, 0);
 
-	result = client->sctx->matchingview(&netaddr, &client->destaddr,
-					    client->message, env, &sigresult,
-					    &client->view);
+	result = client->manager->sctx->matchingview(
+		&netaddr, &client->destaddr, client->message, env, &sigresult,
+		&client->view);
 	if (result != ISC_R_SUCCESS) {
 		char classname[DNS_RDATACLASS_FORMATSIZE];
 
@@ -2056,10 +2060,10 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 	if (result != ISC_R_NOTFOUND) {
 		signame = NULL;
 		if (dns_message_gettsig(client->message, &signame) != NULL) {
-			ns_stats_increment(client->sctx->nsstats,
+			ns_stats_increment(client->manager->sctx->nsstats,
 					   ns_statscounter_tsigin);
 		} else {
-			ns_stats_increment(client->sctx->nsstats,
+			ns_stats_increment(client->manager->sctx->nsstats,
 					   ns_statscounter_sig0in);
 		}
 	}
@@ -2085,7 +2089,7 @@ ns__client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		isc_result_t tresult;
 
 		/* There is a signature, but it is bad. */
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_invalidsig);
 		signame = NULL;
 		if (dns_message_gettsig(client->message, &signame) != NULL) {
@@ -2285,17 +2289,14 @@ ns__client_setup(ns_client_t *client, ns_clientmgr_t *mgr, bool new) {
 		REQUIRE(client != NULL);
 		REQUIRE(mgr->tid == isc_nm_tid());
 
-		*client = (ns_client_t){ .magic = 0, .tid = mgr->tid };
+		*client = (ns_client_t){ .magic = 0 };
 
-		isc_mem_attach(mgr->mctx, &client->mctx);
 		clientmgr_attach(mgr, &client->manager);
-		ns_server_attach(mgr->sctx, &client->sctx);
-		isc_task_attach(mgr->task, &client->task);
 
-		dns_message_create(client->mctx, DNS_MESSAGE_INTENTPARSE,
-				   &client->message);
+		dns_message_create(client->manager->mctx,
+				   DNS_MESSAGE_INTENTPARSE, &client->message);
 
-		client->sendbuf = isc_mem_get(client->mctx,
+		client->sendbuf = isc_mem_get(client->manager->mctx,
 					      NS_CLIENT_SEND_BUFFER_SIZE);
 		/*
 		 * Set magic earlier than usual because ns_query_init()
@@ -2308,30 +2309,19 @@ ns__client_setup(ns_client_t *client, ns_clientmgr_t *mgr, bool new) {
 		}
 	} else {
 		REQUIRE(NS_CLIENT_VALID(client));
-		REQUIRE(client->tid == isc_nm_tid());
-
-		ns_clientmgr_t *oldmgr = client->manager;
-		ns_server_t *sctx = client->sctx;
-		isc_task_t *task = client->task;
-		unsigned char *sendbuf = client->sendbuf;
-		dns_message_t *message = client->message;
-		isc_mem_t *oldmctx = client->mctx;
-		ns_query_t query = client->query;
-		int tid = client->tid;
+		REQUIRE(client->manager->tid == isc_nm_tid());
 
 		/*
 		 * Retain these values from the existing client, but
 		 * zero every thing else.
 		 */
-		*client = (ns_client_t){ .magic = 0,
-					 .mctx = oldmctx,
-					 .manager = oldmgr,
-					 .sctx = sctx,
-					 .task = task,
-					 .sendbuf = sendbuf,
-					 .message = message,
-					 .query = query,
-					 .tid = tid };
+		*client = (ns_client_t){
+			.magic = 0,
+			.manager = client->manager,
+			.sendbuf = client->sendbuf,
+			.message = client->message,
+			.query = client->query,
+		};
 	}
 
 	client->query.attributes &= ~NS_QUERYATTR_ANSWERED;
@@ -2354,7 +2344,7 @@ ns__client_setup(ns_client_t *client, ns_clientmgr_t *mgr, bool new) {
 
 cleanup:
 	if (client->sendbuf != NULL) {
-		isc_mem_put(client->mctx, client->sendbuf,
+		isc_mem_put(client->manager->mctx, client->sendbuf,
 			    NS_CLIENT_SEND_BUFFER_SIZE);
 	}
 
@@ -2362,17 +2352,9 @@ cleanup:
 		dns_message_detach(&client->message);
 	}
 
-	if (client->task != NULL) {
-		isc_task_detach(&client->task);
-	}
-
 	if (client->manager != NULL) {
 		clientmgr_detach(&client->manager);
 	}
-	isc_mem_detach(&client->mctx);
-	if (client->sctx != NULL) {
-		ns_server_detach(&client->sctx);
-	}
 
 	return (result);
 }
@@ -2709,12 +2691,12 @@ ns_client_dumpmessage(ns_client_t *client, const char *reason) {
 	 */
 
 	do {
-		buf = isc_mem_get(client->mctx, len);
+		buf = isc_mem_get(client->manager->mctx, len);
 		isc_buffer_init(&buffer, buf, len);
 		result = dns_message_totext(
 			client->message, &dns_master_style_debug, 0, &buffer);
 		if (result == ISC_R_NOSPACE) {
-			isc_mem_put(client->mctx, buf, len);
+			isc_mem_put(client->manager->mctx, buf, len);
 			len += 1024;
 		} else if (result == ISC_R_SUCCESS) {
 			ns_client_log(client, NS_LOGCATEGORY_CLIENT,
@@ -2725,7 +2707,7 @@ ns_client_dumpmessage(ns_client_t *client, const char *reason) {
 	} while (result == ISC_R_NOSPACE);
 
 	if (buf != NULL) {
-		isc_mem_put(client->mctx, buf, len);
+		isc_mem_put(client->manager->mctx, buf, len);
 	}
 }
 
@@ -2863,7 +2845,7 @@ ns_client_newnamebuf(ns_client_t *client) {
 
 	CTRACE("ns_client_newnamebuf");
 
-	isc_buffer_allocate(client->mctx, &dbuf, 1024);
+	isc_buffer_allocate(client->manager->mctx, &dbuf, 1024);
 	ISC_LIST_APPEND(client->query.namebufs, dbuf, link);
 
 	CTRACE("ns_client_newnamebuf: done");
@@ -2962,7 +2944,8 @@ ns_client_newdbversion(ns_client_t *client, unsigned int n) {
 	ns_dbversion_t *dbversion = NULL;
 
 	for (i = 0; i < n; i++) {
-		dbversion = isc_mem_get(client->mctx, sizeof(*dbversion));
+		dbversion = isc_mem_get(client->manager->mctx,
+					sizeof(*dbversion));
 		*dbversion = (ns_dbversion_t){ 0 };
 		ISC_LIST_INITANDAPPEND(client->query.freeversions, dbversion,
 				       link);
diff --git a/lib/ns/include/ns/client.h b/lib/ns/include/ns/client.h
index c5d8e86cf7..efd98a9912 100644
--- a/lib/ns/include/ns/client.h
+++ b/lib/ns/include/ns/client.h
@@ -168,17 +168,12 @@ struct ns_clientmgr {
 /*% nameserver client structure */
 struct ns_client {
 	unsigned int	 magic;
-	isc_mem_t	  *mctx;
-	int		 tid;
-	bool		 allocated; /* Do we need to free it? */
-	ns_server_t	    *sctx;
 	ns_clientmgr_t  *manager;
 	ns_clientstate_t state;
 	int		 nupdates;
 	bool		 nodetach;
 	bool		 shuttingdown;
 	unsigned int	 attributes;
-	isc_task_t	   *task;
 	dns_view_t	   *view;
 	dns_dispatch_t  *dispatch;
 	isc_nmhandle_t  *handle;	/* Permanent pointer to handle */
@@ -204,7 +199,6 @@ struct ns_client {
 	isc_time_t    tnow;
 	dns_name_t    signername; /*%< [T]SIG key name */
 	dns_name_t   *signer;	  /*%< NULL if not valid sig */
-	bool	      mortal;	  /*%< Die after handling request */
 	isc_quota_t  *recursionquota;
 
 	isc_sockaddr_t peeraddr;
@@ -214,8 +208,6 @@ struct ns_client {
 
 	dns_ecs_t ecs; /*%< EDNS client subnet sent by client */
 
-	struct in6_pktinfo pktinfo;
-	isc_dscp_t	   dscp;
 	/*%
 	 * Information about recent FORMERR response(s), for
 	 * FORMERR loop avoidance.  This is separate for each
diff --git a/lib/ns/query.c b/lib/ns/query.c
index 739f1b6688..3ec00258ad 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -520,7 +520,7 @@ inc_stats(ns_client_t *client, isc_statscounter_t counter) {
 	isc_stats_t *zonestats;
 	dns_stats_t *querystats = NULL;
 
-	ns_stats_increment(client->sctx->nsstats, counter);
+	ns_stats_increment(client->manager->sctx->nsstats, counter);
 
 	if (zone == NULL) {
 		return;
@@ -604,7 +604,7 @@ query_error(ns_client_t *client, isc_result_t result, int line) {
 		break;
 	}
 
-	if ((client->sctx->options & NS_SERVER_LOGQUERIES) != 0) {
+	if ((client->manager->sctx->options & NS_SERVER_LOGQUERIES) != 0) {
 		loglevel = ISC_LOG_INFO;
 	}
 
@@ -649,7 +649,7 @@ query_freefreeversions(ns_client_t *client, bool everything) {
 		if (i > 3 || everything) {
 			ISC_LIST_UNLINK(client->query.freeversions, dbversion,
 					link);
-			isc_mem_put(client->mctx, dbversion,
+			isc_mem_put(client->manager->mctx, dbversion,
 				    sizeof(*dbversion));
 		}
 	}
@@ -716,7 +716,7 @@ query_reset(ns_client_t *client, bool everything) {
 		ns_client_putrdataset(client, &client->query.dns64_sigaaaa);
 	}
 	if (client->query.dns64_aaaaok != NULL) {
-		isc_mem_put(client->mctx, client->query.dns64_aaaaok,
+		isc_mem_put(client->manager->mctx, client->query.dns64_aaaaok,
 			    client->query.dns64_aaaaoklen * sizeof(bool));
 		client->query.dns64_aaaaok = NULL;
 		client->query.dns64_aaaaoklen = 0;
@@ -762,7 +762,7 @@ query_reset(ns_client_t *client, bool everything) {
 		rpz_st_clear(client);
 		if (everything) {
 			INSIST(client->query.rpz_st->rpsdb == NULL);
-			isc_mem_put(client->mctx, client->query.rpz_st,
+			isc_mem_put(client->manager->mctx, client->query.rpz_st,
 				    sizeof(*client->query.rpz_st));
 			client->query.rpz_st = NULL;
 		}
@@ -1174,7 +1174,7 @@ rpz_log_rewrite(ns_client_t *client, bool disabled, dns_rpz_policy_t policy,
 	 * Count both enabled and disabled rewrites for each zone.
 	 */
 	if (!disabled && policy != DNS_RPZ_POLICY_PASSTHRU) {
-		ns_stats_increment(client->sctx->nsstats,
+		ns_stats_increment(client->manager->sctx->nsstats,
 				   ns_statscounter_rpz_rewrites);
 	}
 	if (p_zone != NULL) {
@@ -2357,7 +2357,7 @@ get_key(ns_client_t *client, dns_db_t *db, dns_rdata_rrsig_t *rrsig,
 		isc_buffer_init(&b, rdata.data, rdata.length);
 		isc_buffer_add(&b, rdata.length);
 		result = dst_key_fromdns(&rrsig->signer, rdata.rdclass, &b,
-					 client->mctx, keyp);
+					 client->manager->mctx, keyp);
 		if (result != ISC_R_SUCCESS) {
 			continue;
 		}
@@ -2384,8 +2384,8 @@ verify(dst_key_t *key, dns_name_t *name, dns_rdataset_t *rdataset,
 
 again:
 	result = dns_dnssec_verify(name, rdataset, key, ignore,
-				   client->view->maxbits, client->mctx, rdata,
-				   NULL);
+				   client->view->maxbits, client->manager->mctx,
+				   rdata, NULL);
 	if (result == DNS_R_SIGEXPIRED && client->view->acceptexpired) {
 		ignore = true;
 		goto again;
@@ -2514,7 +2514,7 @@ prefetch_done(isc_task_t *task, isc_event_t *event) {
 	REQUIRE(event->ev_type == DNS_EVENT_FETCHDONE);
 	client = devent->ev_arg;
 	REQUIRE(NS_CLIENT_VALID(client));
-	REQUIRE(task == client->task);
+	REQUIRE(task == client->manager->task);
 
 	CTRACE(ISC_LOG_DEBUG(3), "prefetch_done");
 
@@ -2530,7 +2530,7 @@ prefetch_done(isc_task_t *task, isc_event_t *event) {
 	 */
 	if (client->recursionquota != NULL) {
 		isc_quota_detach(&client->recursionquota);
-		ns_stats_decrement(client->sctx->nsstats,
+		ns_stats_decrement(client->manager->sctx->nsstats,
 				   ns_statscounter_recursclients);
 	}
 
@@ -2557,11 +2557,12 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
 	}
 
 	if (client->recursionquota == NULL) {
-		result = isc_quota_attach(&client->sctx->recursionquota,
-					  &client->recursionquota);
+		result =
+			isc_quota_attach(&client->manager->sctx->recursionquota,
+					 &client->recursionquota);
 		switch (result) {
 		case ISC_R_SUCCESS:
-			ns_stats_increment(client->sctx->nsstats,
+			ns_stats_increment(client->manager->sctx->nsstats,
 					   ns_statscounter_recursclients);
 			break;
 		case ISC_R_SOFTQUOTA:
@@ -2587,8 +2588,8 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
 	options = client->query.fetchoptions | DNS_FETCHOPT_PREFETCH;
 	result = dns_resolver_createfetch(
 		client->view->resolver, qname, rdataset->type, NULL, NULL, NULL,
-		peeraddr, client->message->id, options, 0, NULL, client->task,
-		prefetch_done, client, tmprdataset, NULL,
+		peeraddr, client->message->id, options, 0, NULL,
+		client->manager->task, prefetch_done, client, tmprdataset, NULL,
 		&client->query.prefetch);
 	if (result != ISC_R_SUCCESS) {
 		ns_client_putrdataset(client, &tmprdataset);
@@ -2596,7 +2597,8 @@ query_prefetch(ns_client_t *client, dns_name_t *qname,
 	}
 
 	dns_rdataset_clearprefetch(rdataset);
-	ns_stats_increment(client->sctx->nsstats, ns_statscounter_prefetch);
+	ns_stats_increment(client->manager->sctx->nsstats,
+			   ns_statscounter_prefetch);
 }
 
 static void
@@ -2774,11 +2776,12 @@ query_rpzfetch(ns_client_t *client, dns_name_t *qname, dns_rdatatype_t type) {
 	}
 
 	if (client->recursionquota == NULL) {
-		result = isc_quota_attach(&client->sctx->recursionquota,
-					  &client->recursionquota);
+		result =
+			isc_quota_attach(&client->manager->sctx->recursionquota,
+					 &client->recursionquota);
 		switch (result) {
 		case ISC_R_SUCCESS:
-			ns_stats_increment(client->sctx->nsstats,
+			ns_stats_increment(client->manager->sctx->nsstats,
 					   ns_statscounter_recursclients);
 			break;
 		case ISC_R_SOFTQUOTA:
@@ -2804,7 +2807,7 @@ query_rpzfetch(ns_client_t *client, dns_name_t *qname, dns_rdatatype_t type) {
 	isc_nmhandle_attach(client->handle, &client->prefetchhandle);
 	result = dns_resolver_createfetch(
 		client->view->resolver, qname, type, NULL, NULL, NULL, peeraddr,
-		client->message->id, options, 0, NULL, client->task,
+		client->message->id, options, 0, NULL, client->manager->task,
 		prefetch_done, client, tmprdataset, NULL,
 		&client->query.prefetch);
 	if (result != ISC_R_SUCCESS) {
@@ -4019,7 +4022,7 @@ rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype, isc_result_t qresult,
 #endif /* ifndef USE_DNSRPS */
 
 	if (st == NULL) {
-		st = isc_mem_get(client->mctx, sizeof(*st));
+		st = isc_mem_get(client->manager->mctx, sizeof(*st));
 		st->state = 0;
 		st->rpsdb = NULL;
 	}
@@ -4045,7 +4048,7 @@ rpz_rewrite(ns_client_t *client, dns_rdatatype_t qtype, isc_result_t qresult,
 			}
 			result = dns_dnsrps_rewrite_init(
 				&emsg, st, rpzs, client->query.qname,
-				client->mctx, RECURSIONOK(client));
+				client->manager->mctx, RECURSIONOK(client));
 			if (result != ISC_R_SUCCESS) {
 				rpz_log_fail(client, DNS_RPZ_ERROR_LEVEL, NULL,
 					     DNS_RPZ_TYPE_QNAME, emsg.c,
@@ -4779,7 +4782,7 @@ dns64_aaaaok(ns_client_t *client, dns_rdataset_t *rdataset,
 	}
 
 	count = dns_rdataset_count(rdataset);
-	aaaaok = isc_mem_get(client->mctx, sizeof(bool) * count);
+	aaaaok = isc_mem_get(client->manager->mctx, sizeof(bool) * count);
 
 	isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 	if (dns_dns64_aaaaok(dns64, &netaddr, client->signer, env, flags,
@@ -4793,12 +4796,14 @@ dns64_aaaaok(ns_client_t *client, dns_rdataset_t *rdataset,
 			}
 		}
 		if (aaaaok != NULL) {
-			isc_mem_put(client->mctx, aaaaok, sizeof(bool) * count);
+			isc_mem_put(client->manager->mctx, aaaaok,
+				    sizeof(bool) * count);
 		}
 		return (true);
 	}
 	if (aaaaok != NULL) {
-		isc_mem_put(client->mctx, aaaaok, sizeof(bool) * count);
+		isc_mem_put(client->manager->mctx, aaaaok,
+			    sizeof(bool) * count);
 	}
 	return (false);
 }
@@ -6130,7 +6135,7 @@ fetch_callback(isc_task_t *task, isc_event_t *event) {
 	client = devent->ev_arg;
 
 	REQUIRE(NS_CLIENT_VALID(client));
-	REQUIRE(task == client->task);
+	REQUIRE(task == client->manager->task);
 	REQUIRE(RECURSING(client));
 
 	CTRACE(ISC_LOG_DEBUG(3), "fetch_callback");
@@ -6191,7 +6196,7 @@ fetch_callback(isc_task_t *task, isc_event_t *event) {
 
 	if (client->recursionquota != NULL) {
 		isc_quota_detach(&client->recursionquota);
-		ns_stats_decrement(client->sctx->nsstats,
+		ns_stats_decrement(client->manager->sctx->nsstats,
 				   ns_statscounter_recursclients);
 	}
 
@@ -6326,10 +6331,11 @@ check_recursionquota(ns_client_t *client) {
 	 * connection was accepted (if allowed by the TCP quota).
 	 */
 	if (client->recursionquota == NULL) {
-		result = isc_quota_attach(&client->sctx->recursionquota,
-					  &client->recursionquota);
+		result =
+			isc_quota_attach(&client->manager->sctx->recursionquota,
+					 &client->recursionquota);
 		if (result == ISC_R_SUCCESS || result == ISC_R_SOFTQUOTA) {
-			ns_stats_increment(client->sctx->nsstats,
+			ns_stats_increment(client->manager->sctx->nsstats,
 					   ns_statscounter_recursclients);
 		}
 
@@ -6357,7 +6363,7 @@ check_recursionquota(ns_client_t *client) {
 			isc_stdtime_t now;
 			isc_stdtime_get(&now);
 			if (now != atomic_load_relaxed(&last_hard)) {
-				ns_server_t *sctx = client->sctx;
+				ns_server_t *sctx = client->manager->sctx;
 				atomic_store_relaxed(&last_hard, now);
 				ns_client_log(
 					client, NS_LOGCATEGORY_CLIENT,
@@ -6455,8 +6461,8 @@ ns_query_recurse(ns_client_t *client, dns_rdatatype_t qtype, dns_name_t *qname,
 	result = dns_resolver_createfetch(
 		client->view->resolver, qname, qtype, qdomain, nameservers,
 		NULL, peeraddr, client->message->id, client->query.fetchoptions,
-		0, NULL, client->task, fetch_callback, client, rdataset,
-		sigrdataset, &client->query.fetch);
+		0, NULL, client->manager->task, fetch_callback, client,
+		rdataset, sigrdataset, &client->query.fetch);
 	if (result != ISC_R_SUCCESS) {
 		isc_nmhandle_detach(&client->fetchhandle);
 		ns_client_putrdataset(client, &rdataset);
@@ -6688,7 +6694,7 @@ query_hookresume(isc_task_t *task, isc_event_t *event) {
 	CTRACE(ISC_LOG_DEBUG(3), "query_hookresume");
 
 	REQUIRE(NS_CLIENT_VALID(client));
-	REQUIRE(task == client->task);
+	REQUIRE(task == client->manager->task);
 	REQUIRE(event->ev_type == NS_EVENT_HOOKASYNCDONE);
 
 	LOCK(&client->query.fetchlock);
@@ -6705,7 +6711,7 @@ query_hookresume(isc_task_t *task, isc_event_t *event) {
 
 	if (client->recursionquota != NULL) {
 		isc_quota_detach(&client->recursionquota);
-		ns_stats_decrement(client->sctx->nsstats,
+		ns_stats_decrement(client->manager->sctx->nsstats,
 				   ns_statscounter_recursclients);
 	}
 
@@ -6822,7 +6828,7 @@ query_hookresume(isc_task_t *task, isc_event_t *event) {
 
 	hctx->destroy(&hctx);
 	qctx_destroy(qctx);
-	isc_mem_put(client->mctx, qctx, sizeof(*qctx));
+	isc_mem_put(client->manager->mctx, qctx, sizeof(*qctx));
 	isc_event_free(&event);
 }
 
@@ -6844,10 +6850,11 @@ ns_query_hookasync(query_ctx_t *qctx, ns_query_starthookasync_t runasync,
 		goto cleanup;
 	}
 
-	saved_qctx = isc_mem_get(client->mctx, sizeof(*saved_qctx));
+	saved_qctx = isc_mem_get(client->manager->mctx, sizeof(*saved_qctx));
 	qctx_save(qctx, saved_qctx);
-	result = runasync(saved_qctx, client->mctx, arg, client->task,
-			  query_hookresume, client, &client->query.hookactx);
+	result = runasync(saved_qctx, client->manager->mctx, arg,
+			  client->manager->task, query_hookresume, client,
+			  &client->query.hookactx);
 	if (result != ISC_R_SUCCESS) {
 		goto cleanup;
 	}
@@ -6885,7 +6892,8 @@ cleanup:
 		qctx_clean(saved_qctx);
 		qctx_freedata(saved_qctx);
 		qctx_destroy(saved_qctx);
-		isc_mem_put(client->mctx, saved_qctx, sizeof(*saved_qctx));
+		isc_mem_put(client->manager->mctx, saved_qctx,
+			    sizeof(*saved_qctx));
 	}
 	qctx->detach_client = true;
 	return (result);
@@ -6912,7 +6920,7 @@ ns__query_sfcache(query_ctx_t *qctx) {
 
 	flags = 0;
 #ifdef ENABLE_AFL
-	if (qctx->client->sctx->fuzztype == isc_fuzz_resolver) {
+	if (qctx->client->manager->sctx->fuzztype == isc_fuzz_resolver) {
 		failcache = false;
 	} else {
 		failcache = dns_badcache_find(
@@ -8279,7 +8287,7 @@ query_dns64(query_ctx_t *qctx) {
 
 	isc_netaddr_fromsockaddr(&netaddr, &client->peeraddr);
 
-	isc_buffer_allocate(client->mctx, &buffer,
+	isc_buffer_allocate(client->manager->mctx, &buffer,
 			    view->dns64cnt * 16 *
 				    dns_rdataset_count(qctx->rdataset));
 	result = dns_message_gettemprdataset(client->message, &dns64_rdataset);
@@ -8459,7 +8467,7 @@ query_filter64(query_ctx_t *qctx) {
 		client->query.attributes &= ~NS_QUERYATTR_SECURE;
 	}
 
-	isc_buffer_allocate(client->mctx, &buffer,
+	isc_buffer_allocate(client->manager->mctx, &buffer,
 			    16 * dns_rdataset_count(qctx->rdataset));
 	result = dns_message_gettemprdataset(client->message, &myrdataset);
 	if (result != ISC_R_SUCCESS) {
@@ -9271,7 +9279,7 @@ query_sign_nodata(query_ctx_t *qctx) {
 			 */
 			if (dns_rdataset_isassociated(qctx->rdataset) &&
 			    !dns_name_equal(qname, found) &&
-			    (((qctx->client->sctx->options &
+			    (((qctx->client->manager->sctx->options &
 			       NS_SERVER_NONEAREST) == 0) ||
 			     qctx->qtype == dns_rdatatype_ds))
 			{
@@ -10779,7 +10787,7 @@ query_addsoa(query_ctx_t *qctx, unsigned int override_ttl,
 	/*
 	 * Don't add the SOA record for test which set "-T nosoa".
 	 */
-	if (((client->sctx->options & NS_SERVER_NOSOA) != 0) &&
+	if (((client->manager->sctx->options & NS_SERVER_NOSOA) != 0) &&
 	    (!WANTDNSSEC(client) || !dns_rdataset_isassociated(qctx->rdataset)))
 	{
 		return (ISC_R_SUCCESS);
@@ -11800,7 +11808,7 @@ log_tat(ns_client_t *client) {
 	if (client->query.qtype == dns_rdatatype_dnskey) {
 		uint16_t keytags = client->keytag_len / 2;
 		size_t len = taglen = sizeof("65000") * keytags + 1;
-		char *cp = tags = isc_mem_get(client->mctx, taglen);
+		char *cp = tags = isc_mem_get(client->manager->mctx, taglen);
 		int i = 0;
 
 		INSIST(client->keytag != NULL);
@@ -11826,7 +11834,7 @@ log_tat(ns_client_t *client) {
 		      ISC_LOG_INFO, "trust-anchor-telemetry '%s/%s' from %s%s",
 		      namebuf, classbuf, clientbuf, tags != NULL ? tags : "");
 	if (tags != NULL) {
-		isc_mem_put(client->mctx, tags, taglen);
+		isc_mem_put(client->manager->mctx, tags, taglen);
 	}
 }
 
@@ -12025,7 +12033,7 @@ ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) {
 		return;
 	}
 
-	if ((client->sctx->options & NS_SERVER_LOGQUERIES) != 0) {
+	if ((client->manager->sctx->options & NS_SERVER_LOGQUERIES) != 0) {
 		log_query(client, saved_flags, saved_extflags);
 	}
 
@@ -12035,7 +12043,8 @@ ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) {
 	rdataset = ISC_LIST_HEAD(client->query.qname->list);
 	INSIST(rdataset != NULL);
 	client->query.qtype = qtype = rdataset->type;
-	dns_rdatatypestats_increment(client->sctx->rcvquerystats, qtype);
+	dns_rdatatypestats_increment(client->manager->sctx->rcvquerystats,
+				     qtype);
 
 	log_tat(client);
 
@@ -12084,7 +12093,7 @@ ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) {
 			return;
 		case dns_rdatatype_tkey:
 			result = dns_tkey_processquery(
-				client->message, client->sctx->tkeyctx,
+				client->message, client->manager->sctx->tkeyctx,
 				client->view->dynamickeys);
 			if (result == ISC_R_SUCCESS) {
 				query_send(client);
@@ -12190,7 +12199,7 @@ ns_query_start(ns_client_t *client, isc_nmhandle_t *handle) {
 	 * If "-T noaa" has been set on the command line don't set
 	 * AA on authoritative answers.
 	 */
-	if ((client->sctx->options & NS_SERVER_NOAA) == 0) {
+	if ((client->manager->sctx->options & NS_SERVER_NOAA) == 0) {
 		message->flags |= DNS_MESSAGEFLAG_AA;
 	}
 
diff --git a/lib/ns/tests/query_test.c b/lib/ns/tests/query_test.c
index 9c8005fa5f..35cb4b89c6 100644
--- a/lib/ns/tests/query_test.c
+++ b/lib/ns/tests/query_test.c
@@ -933,7 +933,7 @@ run_hookasync_test(const ns__query_hookasync_test_params_t *test) {
 	}
 
 	/* Remember SERVFAIL counter */
-	srvfail_cnt = ns_stats_get_counter(qctx->client->sctx->nsstats,
+	srvfail_cnt = ns_stats_get_counter(qctx->client->manager->sctx->nsstats,
 					   ns_statscounter_servfail);
 
 	/*
@@ -983,9 +983,9 @@ run_hookasync_test(const ns__query_hookasync_test_params_t *test) {
 		INSIST(qctx->client->query.hookactx == NULL);
 		INSIST(qctx->client->state == NS_CLIENTSTATE_WORKING);
 		INSIST(qctx->client->recursionquota == NULL);
-		INSIST(ns_stats_get_counter(qctx->client->sctx->nsstats,
-					    ns_statscounter_recursclients) ==
-		       0);
+		INSIST(ns_stats_get_counter(
+			       qctx->client->manager->sctx->nsstats,
+			       ns_statscounter_recursclients) == 0);
 		INSIST(!ISC_LINK_LINKED(qctx->client, rlink));
 		if (!test->do_cancel) {
 			/*
@@ -1005,9 +1005,9 @@ run_hookasync_test(const ns__query_hookasync_test_params_t *test) {
 	 * Also, the last-generated qctx should have detach_client being true.
 	 */
 	if (expect_servfail) {
-		INSIST(ns_stats_get_counter(qctx->client->sctx->nsstats,
-					    ns_statscounter_servfail) ==
-		       srvfail_cnt + 1);
+		INSIST(ns_stats_get_counter(
+			       qctx->client->manager->sctx->nsstats,
+			       ns_statscounter_servfail) == srvfail_cnt + 1);
 		if (test->do_cancel) {
 			/* qctx was created on resume and copied in hook */
 			INSIST(asdata.qctx.detach_client);
diff --git a/lib/ns/update.c b/lib/ns/update.c
index 2490ff88ec..c96d87071d 100644
--- a/lib/ns/update.c
+++ b/lib/ns/update.c
@@ -323,7 +323,7 @@ update_log_cb(void *arg, dns_zone_t *zone, int level, const char *message) {
  */
 static void
 inc_stats(ns_client_t *client, dns_zone_t *zone, isc_statscounter_t counter) {
-	ns_stats_increment(client->sctx->nsstats, counter);
+	ns_stats_increment(client->manager->sctx->nsstats, counter);
 
 	if (zone != NULL) {
 		isc_stats_t *zonestats = dns_zone_getrequeststats(zone);
@@ -1642,8 +1642,8 @@ send_update_event(ns_client_t *client, dns_zone_t *zone) {
 	isc_task_t *zonetask = NULL;
 
 	event = (update_event_t *)isc_event_allocate(
-		client->mctx, client, DNS_EVENT_UPDATE, update_action, NULL,
-		sizeof(*event));
+		client->manager->mctx, client, DNS_EVENT_UPDATE, update_action,
+		NULL, sizeof(*event));
 	event->zone = zone;
 	event->result = ISC_R_SUCCESS;
 
@@ -2651,7 +2651,7 @@ update_action(isc_task_t *task, isc_event_t *event) {
 	dns_diff_t diff; /* Pending updates. */
 	dns_diff_t temp; /* Pending RR existence assertions. */
 	bool soa_serial_changed = false;
-	isc_mem_t *mctx = client->mctx;
+	isc_mem_t *mctx = client->manager->mctx;
 	dns_rdatatype_t covers;
 	dns_message_t *request = client->message;
 	dns_rdataclass_t zoneclass;
@@ -3646,7 +3646,7 @@ common:
 	uev->ev_type = DNS_EVENT_UPDATEDONE;
 	uev->ev_action = updatedone_action;
 
-	isc_task_send(client->task, &event);
+	isc_task_send(client->manager->task, &event);
 
 	INSIST(ver == NULL);
 	INSIST(event == NULL);
@@ -3660,7 +3660,7 @@ updatedone_action(isc_task_t *task, isc_event_t *event) {
 	UNUSED(task);
 
 	REQUIRE(event->ev_type == DNS_EVENT_UPDATEDONE);
-	REQUIRE(task == client->task);
+	REQUIRE(task == client->manager->task);
 	REQUIRE(client->updatehandle == client->handle);
 
 	INSIST(client->nupdates > 0);
@@ -3721,7 +3721,7 @@ forward_callback(void *arg, isc_result_t result, dns_message_t *answer) {
 		inc_stats(client, zone, ns_statscounter_updaterespfwd);
 	}
 
-	isc_task_send(client->task, ISC_EVENT_PTR(&uev));
+	isc_task_send(client->manager->task, ISC_EVENT_PTR(&uev));
 	dns_zone_detach(&zone);
 }
 
@@ -3752,7 +3752,7 @@ forward_action(isc_task_t *task, isc_event_t *event) {
 	if (result != ISC_R_SUCCESS) {
 		uev->ev_type = DNS_EVENT_UPDATEDONE;
 		uev->ev_action = forward_fail;
-		isc_task_send(client->task, &event);
+		isc_task_send(client->manager->task, &event);
 		inc_stats(client, zone, ns_statscounter_updatefwdfail);
 		dns_zone_detach(&zone);
 	} else {
@@ -3771,8 +3771,8 @@ send_forward_event(ns_client_t *client, dns_zone_t *zone) {
 	isc_task_t *zonetask = NULL;
 
 	event = (update_event_t *)isc_event_allocate(
-		client->mctx, client, DNS_EVENT_UPDATE, forward_action, NULL,
-		sizeof(*event));
+		client->manager->mctx, client, DNS_EVENT_UPDATE, forward_action,
+		NULL, sizeof(*event));
 	event->zone = zone;
 	event->result = ISC_R_SUCCESS;
 
diff --git a/lib/ns/xfrout.c b/lib/ns/xfrout.c
index e2d11fa269..3198e2070a 100644
--- a/lib/ns/xfrout.c
+++ b/lib/ns/xfrout.c
@@ -110,7 +110,7 @@
 
 static void
 inc_stats(ns_client_t *client, dns_zone_t *zone, isc_statscounter_t counter) {
-	ns_stats_increment(client->sctx->nsstats, counter);
+	ns_stats_increment(client->manager->sctx->nsstats, counter);
 	if (zone != NULL) {
 		isc_stats_t *zonestats = dns_zone_getrequeststats(zone);
 		if (zonestats != NULL) {
@@ -733,7 +733,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	dns_rdata_t soa_rdata = DNS_RDATA_INIT;
 	bool have_soa = false;
 	const char *mnemonic = NULL;
-	isc_mem_t *mctx = client->mctx;
+	isc_mem_t *mctx = client->manager->mctx;
 	dns_message_t *request = client->message;
 	xfrout_ctx_t *xfr = NULL;
 	isc_quota_t *quota = NULL;
@@ -766,7 +766,7 @@ ns_xfr_start(ns_client_t *client, dns_rdatatype_t reqtype) {
 	/*
 	 * Apply quota.
 	 */
-	result = isc_quota_attach(&client->sctx->xfroutquota, &quota);
+	result = isc_quota_attach(&client->manager->sctx->xfroutquota, &quota);
 	if (result != ISC_R_SUCCESS) {
 		isc_log_write(XFROUT_COMMON_LOGARGS, ISC_LOG_WARNING,
 			      "%s request denied: %s", mnemonic,
@@ -1535,7 +1535,7 @@ sendstream(xfrout_ctx_t *xfr) {
 		 * here (TCP only).
 		 */
 		if ((isc_buffer_usedlength(&xfr->buf) >=
-		     xfr->client->sctx->transfer_tcp_message_size) &&
+		     xfr->client->manager->sctx->transfer_tcp_message_size) &&
 		    is_tcp)
 		{
 			break;