diff --git a/bin/named/control.c b/bin/named/control.c
index b5f7c49a80..e6bb1c03f9 100644
--- a/bin/named/control.c
+++ b/bin/named/control.c
@@ -148,6 +148,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		      log_level, "received control channel command '%s'",
 		      cmdline);
 
+	dns_cfgmgr_rwtxn();
 	/*
 	 * After the lengthy "halt" and "stop", the commands are
 	 * handled in alphabetical order of the NAMED_COMMAND_ macros.
@@ -305,6 +306,7 @@ named_control_docommand(isccc_sexpr_t *message, bool readonly,
 		result = DNS_R_UNKNOWNCOMMAND;
 	}
 
+	INSIST(dns_cfgmgr_commit() == ISC_R_SUCCESS);
 cleanup:
 	if (lex != NULL) {
 		isc_lex_destroy(&lex);
diff --git a/bin/named/server.c b/bin/named/server.c
index 9e0ad5072b..e8352bdbc3 100644
--- a/bin/named/server.c
+++ b/bin/named/server.c
@@ -7959,14 +7959,15 @@ apply_configuration(cfg_parser_t *configparser, cfg_obj_t *config,
 		dns_cfgmgr_mode(DNS_CFGMGR_MODEUSER);
 		dns_cfgmgr_rwtxn();
 		REQUIRE(dns_cfgmgr_commit() == ISC_R_SUCCESS);
-	}
 
-	/*
-	 * This is false as it should still be on USER mode as we're loading
-	 * user configuration. This is just a workaround until there is a clear
-	 * lifecycle model.
-	 */
-	dns_cfgmgr_mode(DNS_CFGMGR_MODERUNNING);
+		/*
+		 * This is false as it should still be on USER mode as we're
+		 * loading user configuration. This is just a workaround until
+		 * there is a clear lifecycle model.
+		 */
+		dns_cfgmgr_mode(DNS_CFGMGR_MODERUNNING);
+		dns_cfgmgr_rwtxn();
+	}
 
 	/* Let's recreate the TLS context cache */
 	if (server->tlsctx_server_cache != NULL) {
@@ -9287,6 +9288,9 @@ cleanup_exclusive:
 		      ISC_LOG_DEBUG(1), "apply_configuration: %s",
 		      isc_result_totext(result));
 
+	if (first_time) {
+		INSIST(dns_cfgmgr_commit() == ISC_R_SUCCESS);
+	}
 	return result;
 }
 
@@ -9509,7 +9513,9 @@ run_server(void *arg) {
 
 	CHECKFATAL(load_configuration(server, true), "loading configuration");
 
+	dns_cfgmgr_txn();
 	CHECKFATAL(load_zones(server, false), "loading zones");
+	dns_cfgmgr_closetxn();
 #ifdef ENABLE_AFL
 	named_g_run_done = true;
 #endif /* ifdef ENABLE_AFL */
@@ -9527,6 +9533,8 @@ shutdown_server(void *arg) {
 	named_server_t *server = (named_server_t *)arg;
 	bool flush = server->flushonshutdown;
 
+	dns_cfgmgr_rwtxn();
+
 	named_os_notify_systemd("STOPPING=1\n");
 	named_os_notify_close();
 
@@ -9609,6 +9617,7 @@ shutdown_server(void *arg) {
 	dns_db_detach(&server->in_roothints);
 
 	isc_loopmgr_resume(named_g_loopmgr);
+	INSIST(dns_cfgmgr_commit() == ISC_R_SUCCESS);
 }
 
 static isc_result_t
diff --git a/lib/dns/acl.c b/lib/dns/acl.c
index 71105cc7e7..9d3b607939 100644
--- a/lib/dns/acl.c
+++ b/lib/dns/acl.c
@@ -803,27 +803,14 @@ void
 dns_acl_set(const void *owner, const char *path, const dns_acl_t *acl) {
 	REQUIRE(acl == NULL || DNS_ACL_VALID(acl));
 
-	/*
-	 * Temporary work around until there is a clear life-cycle model of the
-	 * transaction
-	 */
-	dns_cfgmgr_rwtxn();
 	dns_cfgmgr_setref(owner, path, (void *)acl, acl_cfgmgrattach,
 			  acl_cfgmgrdetach);
-	REQUIRE(dns_cfgmgr_commit() == ISC_R_SUCCESS);
 }
 
 dns_acl_t *
 dns_acl_get(const void *owner, const char *path) {
 	dns_acl_t *acl = NULL;
 
-	/*
-	 * Temporary work around until there is a clear life-cycle model of the
-	 * transaction
-	 */
-	dns_cfgmgr_txn();
 	(void)dns_cfgmgr_getref(owner, path, (void **)&acl);
-	dns_cfgmgr_closetxn();
-
 	return acl;
 }
diff --git a/lib/dns/resolver.c b/lib/dns/resolver.c
index 1576f29e55..1fb2bf9854 100644
--- a/lib/dns/resolver.c
+++ b/lib/dns/resolver.c
@@ -7360,6 +7360,8 @@ resquery_response(isc_result_t eresult, isc_region_t *region, void *arg) {
 		return;
 	}
 
+	dns_cfgmgr_txn();
+
 	REQUIRE(VALID_QUERY(query));
 	fctx = query->fctx;
 	REQUIRE(VALID_FCTX(fctx));
@@ -7535,6 +7537,8 @@ resquery_response(isc_result_t eresult, isc_region_t *region, void *arg) {
 
 cleanup:
 	isc_mem_putanddetach(&rctx->mctx, rctx, sizeof(*rctx));
+
+	dns_cfgmgr_closetxn();
 }
 
 static void
diff --git a/lib/dns/zone.c b/lib/dns/zone.c
index 7aa4fbf43c..3e0f4147e8 100644
--- a/lib/dns/zone.c
+++ b/lib/dns/zone.c
@@ -2540,6 +2540,7 @@ zone_asyncload(void *arg) {
 	dns_zone_t *zone = asl->zone;
 	isc_result_t result;
 
+	dns_cfgmgr_txn();
 	REQUIRE(DNS_ZONE_VALID(zone));
 
 	LOCK_ZONE(zone);
@@ -2556,6 +2557,7 @@ zone_asyncload(void *arg) {
 
 	isc_mem_put(zone->mctx, asl, sizeof(*asl));
 	dns_zone_idetach(&zone);
+	dns_cfgmgr_closetxn();
 }
 
 isc_result_t
@@ -5906,6 +5908,13 @@ closeversion:
 	return answer;
 }
 
+static void
+zone_shutdown_inloop(void *zone) {
+	dns_cfgmgr_rwtxn();
+	zone_shutdown(zone);
+	INSIST(dns_cfgmgr_commit() == ISC_R_SUCCESS);
+}
+
 static void
 zone_destroy(dns_zone_t *zone) {
 	/*
@@ -5926,7 +5935,7 @@ zone_destroy(dns_zone_t *zone) {
 		 * This zone has a loop; it can clean
 		 * itself up asynchronously.
 		 */
-		isc_async_run(zone->loop, zone_shutdown, zone);
+		isc_async_run(zone->loop, zone_shutdown_inloop, zone);
 	}
 }
 
@@ -10410,6 +10419,8 @@ keyfetch_done(void *arg) {
 	dns_rdataset_t *dnskeys = NULL, *dnskeysigs = NULL;
 	dns_rdataset_t *keydataset = NULL, dsset;
 
+	dns_cfgmgr_rwtxn();
+
 	INSIST(resp != NULL);
 
 	kfetch = resp->arg;
@@ -11025,6 +11036,8 @@ cleanup:
 	}
 
 	INSIST(ver == NULL);
+
+	INSIST(dns_cfgmgr_commit() == ISC_R_SUCCESS);
 }
 
 static void
@@ -15162,7 +15175,9 @@ zone_timer(void *arg) {
 
 	REQUIRE(DNS_ZONE_VALID(zone));
 
+	dns_cfgmgr_txn();
 	zone_maintenance(zone);
+	dns_cfgmgr_closetxn();
 }
 
 static void
@@ -16795,6 +16810,7 @@ receive_secure_serial(void *arg) {
 	isc_time_t timenow;
 	int level = ISC_LOG_ERROR;
 
+	dns_cfgmgr_txn();
 	ENTER;
 
 	LOCK_ZONE(zone);
@@ -16930,6 +16946,7 @@ receive_secure_serial(void *arg) {
 			dns_journal_destroy(&rjournal);
 		}
 		isc_async_run(zone->loop, receive_secure_serial, rss);
+		dns_cfgmgr_closetxn();
 		return;
 	}
 
@@ -17024,6 +17041,7 @@ failure:
 	dns_diff_clear(&zone->rss_diff);
 
 	dns_zone_idetach(&zone);
+	dns_cfgmgr_closetxn();
 }
 
 static isc_result_t
@@ -17367,6 +17385,7 @@ receive_secure_db(void *arg) {
 	unsigned int oldserial = 0, *oldserialp = NULL;
 	nsec3paramlist_t nsec3list;
 
+	dns_cfgmgr_txn();
 	ISC_LIST_INIT(nsec3list);
 
 	LOCK_ZONE(zone);
@@ -17482,6 +17501,7 @@ failure:
 	dns_zone_idetach(&zone);
 
 	INSIST(version == NULL);
+	dns_cfgmgr_closetxn();
 }
 
 static isc_result_t
@@ -18057,6 +18077,7 @@ zone_loaddone(void *arg, isc_result_t result) {
 
 	zone = load->zone;
 
+	dns_cfgmgr_txn();
 	ENTER;
 
 	/*
@@ -18119,6 +18140,8 @@ again:
 	isc_mem_put(zone->mctx, load, sizeof(*load));
 
 	dns_zone_idetach(&zone);
+
+	dns_cfgmgr_closetxn();
 }
 
 void
diff --git a/lib/ns/client.c b/lib/ns/client.c
index 94a3d358d7..0d7fa38305 100644
--- a/lib/ns/client.c
+++ b/lib/ns/client.c
@@ -1861,6 +1861,8 @@ ns_client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		return;
 	}
 
+	dns_cfgmgr_txn();
+
 	client = isc_nmhandle_getdata(handle);
 	if (client == NULL) {
 		ns_interface_t *ifp = (ns_interface_t *)arg;
@@ -1922,6 +1924,7 @@ ns_client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(10),
 			      "dropped request: suspicious port");
 		isc_nm_bad_request(handle);
+		dns_cfgmgr_closetxn();
 		return;
 	}
 #endif /* if NS_CLIENT_DROPPORT */
@@ -1936,6 +1939,7 @@ ns_client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(10),
 			      "dropped request: blackholed peer");
 		isc_nm_bad_request(handle);
+		dns_cfgmgr_closetxn();
 		return;
 	}
 
@@ -1953,6 +1957,7 @@ ns_client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(10),
 			      "dropped request: invalid message header");
 		isc_nm_bad_request(handle);
+		dns_cfgmgr_closetxn();
 		return;
 	}
 
@@ -1972,6 +1977,7 @@ ns_client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 			      NS_LOGMODULE_CLIENT, ISC_LOG_DEBUG(10),
 			      "dropped request: unexpected response");
 		isc_nm_bad_request(handle);
+		dns_cfgmgr_closetxn();
 		return;
 	}
 
@@ -2037,6 +2043,7 @@ ns_client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 			result = DNS_R_FORMERR;
 		}
 		ns_client_error(client, result);
+		dns_cfgmgr_closetxn();
 		return;
 	}
 
@@ -2077,6 +2084,7 @@ ns_client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		    0)
 		{
 			ns_client_error(client, DNS_R_FORMERR);
+			dns_cfgmgr_closetxn();
 			return;
 		}
 
@@ -2087,6 +2095,7 @@ ns_client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		    0)
 		{
 			ns_client_error(client, DNS_R_NOTIMP);
+			dns_cfgmgr_closetxn();
 			return;
 		}
 
@@ -2097,6 +2106,7 @@ ns_client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		    0)
 		{
 			ns_client_error(client, DNS_R_REFUSED);
+			dns_cfgmgr_closetxn();
 			return;
 		}
 
@@ -2106,11 +2116,13 @@ ns_client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		if ((client->manager->sctx->options & NS_SERVER_DROPEDNS) != 0)
 		{
 			ns_client_drop(client, ISC_R_SUCCESS);
+			dns_cfgmgr_closetxn();
 			return;
 		}
 
 		result = process_opt(client, opt);
 		if (result != ISC_R_SUCCESS) {
+			dns_cfgmgr_closetxn();
 			return;
 		}
 	}
@@ -2123,6 +2135,7 @@ ns_client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 			result = dns_message_reply(client->message, true);
 			if (result != ISC_R_SUCCESS) {
 				ns_client_error(client, result);
+				dns_cfgmgr_closetxn();
 				return;
 			}
 
@@ -2131,6 +2144,7 @@ ns_client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 			}
 
 			ns_client_send(client);
+			dns_cfgmgr_closetxn();
 			return;
 		}
 
@@ -2140,6 +2154,7 @@ ns_client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 		ns_client_dumpmessage(client, "message class could not be "
 					      "determined");
 		ns_client_error(client, notimp ? DNS_R_NOTIMP : DNS_R_FORMERR);
+		dns_cfgmgr_closetxn();
 		return;
 	}
 
@@ -2156,10 +2171,12 @@ ns_client_request(isc_nmhandle_t *handle, isc_result_t eresult,
 
 	result = ns_client_setup_view(client, &netaddr);
 	if (result == DNS_R_WAIT) {
+		dns_cfgmgr_closetxn();
 		return;
 	}
 
 	ns_client_request_continue(client);
+	dns_cfgmgr_closetxn();
 }
 
 static void
diff --git a/lib/ns/query.c b/lib/ns/query.c
index 4c0b57b200..0213fbe4e7 100644
--- a/lib/ns/query.c
+++ b/lib/ns/query.c
@@ -5355,6 +5355,8 @@ ns__query_start(query_ctx_t *qctx) {
 	qctx->need_wildcardproof = false;
 	qctx->rpz = false;
 
+//	dns_cfgmgr_txn();
+
 	CALL_HOOK(NS_QUERY_START_BEGIN, qctx);
 
 	/*
@@ -6056,6 +6058,8 @@ fetch_callback(void *arg) {
 	int errorloglevel;
 	query_ctx_t qctx;
 
+	dns_cfgmgr_txn();
+
 	REQUIRE(NS_CLIENT_VALID(client));
 	REQUIRE(RECURSING(client));
 
@@ -6158,6 +6162,7 @@ fetch_callback(void *arg) {
 	}
 
 	dns_resolver_destroyfetch(&fetch);
+	dns_cfgmgr_closetxn();
 }
 
 /*%
@@ -11242,6 +11247,7 @@ ns_query_done(query_ctx_t *qctx) {
 	const dns_namelist_t *secs = qctx->client->message->sections;
 	bool partial_result_with_servfail = false;
 
+	//dns_cfgmgr_closetxn();
 	CCTRACE(ISC_LOG_DEBUG(3), "ns_query_done");
 
 	CALL_HOOK(NS_QUERY_DONE_BEGIN, qctx);
diff --git a/lib/ns/update.c b/lib/ns/update.c
index 52f1d9b27a..edc19dba3d 100644
--- a/lib/ns/update.c
+++ b/lib/ns/update.c
@@ -2684,6 +2684,8 @@ update_action(void *arg) {
 	uint64_t records;
 	bool is_inline, is_maintain, is_signing;
 
+	dns_cfgmgr_txn();
+
 	dns_diff_init(mctx, &diff);
 	dns_diff_init(mctx, &temp);
 
@@ -3371,6 +3373,8 @@ common:
 
 	isc_async_run(client->manager->loop, updatedone_action, uev);
 	INSIST(ver == NULL);
+
+	dns_cfgmgr_closetxn();
 }
 
 static void
@@ -3378,6 +3382,7 @@ updatedone_action(void *arg) {
 	update_t *uev = (update_t *)arg;
 	ns_client_t *client = uev->client;
 
+	dns_cfgmgr_txn();
 	REQUIRE(client->updatehandle == client->handle);
 
 	switch (uev->result) {
@@ -3400,6 +3405,8 @@ updatedone_action(void *arg) {
 	}
 	isc_mem_put(client->manager->mctx, uev, sizeof(*uev));
 	isc_nmhandle_detach(&client->updatehandle);
+
+	dns_cfgmgr_closetxn();
 }
 
 /*%