diff --git a/cocci/DNS_TYPEPAIR_VALUE.spatch b/cocci/DNS_TYPEPAIR_VALUE.spatch
index 4c512943a1..5172bd1a67 100644
--- a/cocci/DNS_TYPEPAIR_VALUE.spatch
+++ b/cocci/DNS_TYPEPAIR_VALUE.spatch
@@ -4,4 +4,4 @@ expression T;
 @@
 
 - DNS_TYPEPAIR_VALUE(RRSIG, T)
-+ DNS_SIGTYPE(T)
++ DNS_SIGTYPEPAIR(T)
diff --git a/lib/dns/db_p.h b/lib/dns/db_p.h
index 142e72a2f1..4763d2bd7d 100644
--- a/lib/dns/db_p.h
+++ b/lib/dns/db_p.h
@@ -117,39 +117,39 @@ static inline bool
 prio_type(dns_typepair_t type) {
 	switch (type) {
 	case dns_rdatatype_soa:
-	case DNS_SIGTYPE(dns_rdatatype_soa):
+	case DNS_SIGTYPEPAIR(dns_rdatatype_soa):
 	case dns_rdatatype_a:
-	case DNS_SIGTYPE(dns_rdatatype_a):
+	case DNS_SIGTYPEPAIR(dns_rdatatype_a):
 	case dns_rdatatype_mx:
-	case DNS_SIGTYPE(dns_rdatatype_mx):
+	case DNS_SIGTYPEPAIR(dns_rdatatype_mx):
 	case dns_rdatatype_aaaa:
-	case DNS_SIGTYPE(dns_rdatatype_aaaa):
+	case DNS_SIGTYPEPAIR(dns_rdatatype_aaaa):
 	case dns_rdatatype_nsec:
-	case DNS_SIGTYPE(dns_rdatatype_nsec):
+	case DNS_SIGTYPEPAIR(dns_rdatatype_nsec):
 	case dns_rdatatype_nsec3:
-	case DNS_SIGTYPE(dns_rdatatype_nsec3):
+	case DNS_SIGTYPEPAIR(dns_rdatatype_nsec3):
 	case dns_rdatatype_ns:
-	case DNS_SIGTYPE(dns_rdatatype_ns):
+	case DNS_SIGTYPEPAIR(dns_rdatatype_ns):
 	case dns_rdatatype_ds:
-	case DNS_SIGTYPE(dns_rdatatype_ds):
+	case DNS_SIGTYPEPAIR(dns_rdatatype_ds):
 	case dns_rdatatype_cname:
-	case DNS_SIGTYPE(dns_rdatatype_cname):
+	case DNS_SIGTYPEPAIR(dns_rdatatype_cname):
 	case dns_rdatatype_dname:
-	case DNS_SIGTYPE(dns_rdatatype_dname):
+	case DNS_SIGTYPEPAIR(dns_rdatatype_dname):
 	case dns_rdatatype_svcb:
-	case DNS_SIGTYPE(dns_rdatatype_svcb):
+	case DNS_SIGTYPEPAIR(dns_rdatatype_svcb):
 	case dns_rdatatype_https:
-	case DNS_SIGTYPE(dns_rdatatype_https):
+	case DNS_SIGTYPEPAIR(dns_rdatatype_https):
 	case dns_rdatatype_dnskey:
-	case DNS_SIGTYPE(dns_rdatatype_dnskey):
+	case DNS_SIGTYPEPAIR(dns_rdatatype_dnskey):
 	case dns_rdatatype_srv:
-	case DNS_SIGTYPE(dns_rdatatype_srv):
+	case DNS_SIGTYPEPAIR(dns_rdatatype_srv):
 	case dns_rdatatype_txt:
-	case DNS_SIGTYPE(dns_rdatatype_txt):
+	case DNS_SIGTYPEPAIR(dns_rdatatype_txt):
 	case dns_rdatatype_ptr:
-	case DNS_SIGTYPE(dns_rdatatype_ptr):
+	case DNS_SIGTYPEPAIR(dns_rdatatype_ptr):
 	case dns_rdatatype_naptr:
-	case DNS_SIGTYPE(dns_rdatatype_naptr):
+	case DNS_SIGTYPEPAIR(dns_rdatatype_naptr):
 		return true;
 	}
 	return false;
diff --git a/lib/dns/include/dns/rdatatype.h b/lib/dns/include/dns/rdatatype.h
index 4d08ef1f03..07ff817b57 100644
--- a/lib/dns/include/dns/rdatatype.h
+++ b/lib/dns/include/dns/rdatatype.h
@@ -49,8 +49,8 @@
 		DNS__TYPEPAIR_VALUE(base, covers); \
 	})
 
-#define DNS_TYPEPAIR(type) DNS__TYPEPAIR_VALUE(type, dns_rdatatype_none)
-#define DNS_SIGTYPE(type)  DNS__TYPEPAIR_VALUE(dns_rdatatype_rrsig, type)
+#define DNS_TYPEPAIR(type)    DNS__TYPEPAIR_VALUE(type, dns_rdatatype_none)
+#define DNS_SIGTYPEPAIR(type) DNS__TYPEPAIR_VALUE(dns_rdatatype_rrsig, type)
 
 constexpr dns_typepair_t dns_typepair_none = DNS_TYPEPAIR(dns_rdatatype_none);
 constexpr dns_typepair_t dns_typepair_any = DNS_TYPEPAIR(dns_rdatatype_any);
diff --git a/lib/dns/qpcache.c b/lib/dns/qpcache.c
index 1e453162d0..9d02239a24 100644
--- a/lib/dns/qpcache.c
+++ b/lib/dns/qpcache.c
@@ -1279,7 +1279,7 @@ static bool
 both_headers(dns_slabheader_t *header, dns_rdatatype_t type,
 	     dns_slabheader_t **foundp, dns_slabheader_t **foundsigp) {
 	dns_typepair_t typepair = DNS_TYPEPAIR_VALUE(type, 0);
-	dns_typepair_t sigpair = DNS_SIGTYPE(type);
+	dns_typepair_t sigpair = DNS_SIGTYPEPAIR(type);
 
 	bool done = related_headers(header, typepair, sigpair, foundp,
 				    foundsigp, NULL);
@@ -1671,7 +1671,7 @@ qpcache_find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 	found = NULL;
 	foundsig = NULL;
 	typepair = DNS_TYPEPAIR(type);
-	sigpair = DNS_SIGTYPE(type);
+	sigpair = DNS_SIGTYPEPAIR(type);
 	nsheader = NULL;
 	nsecheader = NULL;
 	nssig = NULL;
@@ -1749,11 +1749,11 @@ qpcache_find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 				foundsig = cnamesig;
 			} else {
 				/* Look for CNAME signature instead */
-				sigpair = DNS_SIGTYPE(dns_rdatatype_cname);
+				sigpair = DNS_SIGTYPEPAIR(dns_rdatatype_cname);
 				foundsig = NULL;
 			}
 			break;
-		case DNS_SIGTYPE(dns_rdatatype_cname):
+		case DNS_SIGTYPEPAIR(dns_rdatatype_cname):
 			if (!cname_ok) {
 				break;
 			}
@@ -1764,7 +1764,7 @@ qpcache_find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 			/* Remember the NS rdataset */
 			nsheader = header;
 			break;
-		case DNS_SIGTYPE(dns_rdatatype_ns):
+		case DNS_SIGTYPEPAIR(dns_rdatatype_ns):
 			/* ...and its signature */
 			nssig = header;
 			break;
@@ -1772,7 +1772,7 @@ qpcache_find(dns_db_t *db, const dns_name_t *name, dns_dbversion_t *version,
 		case dns_rdatatype_nsec:
 			nsecheader = header;
 			break;
-		case DNS_SIGTYPE(dns_rdatatype_nsec):
+		case DNS_SIGTYPEPAIR(dns_rdatatype_nsec):
 			nsecsig = header;
 			break;
 
@@ -1951,7 +1951,7 @@ seek_ns_headers(qpc_search_t *search, qpcnode_t *node, dns_dbnode_t **nodep,
 	for (header = node->data; header != NULL; header = header_next) {
 		header_next = header->next;
 		bool ns = header->typepair == DNS_TYPEPAIR(dns_rdatatype_ns) ||
-			  header->typepair == DNS_SIGTYPE(dns_rdatatype_ns);
+			  header->typepair == DNS_SIGTYPEPAIR(dns_rdatatype_ns);
 		if (check_stale_header(header, search, &header_prev)) {
 			if (ns) {
 				/*
@@ -2119,7 +2119,7 @@ qpcache_findrdataset(dns_db_t *db, dns_dbnode_t *node, dns_dbversion_t *version,
 	NODE_RDLOCK(nlock, &nlocktype);
 
 	typepair = DNS_TYPEPAIR_VALUE(type, covers);
-	sigpair = !dns_rdatatype_issig(type) ? DNS_SIGTYPE(type)
+	sigpair = !dns_rdatatype_issig(type) ? DNS_SIGTYPEPAIR(type)
 					     : dns_typepair_none;
 
 	for (header = qpnode->data; header != NULL; header = header_next) {
@@ -2582,7 +2582,7 @@ add(qpcache_t *qpdb, qpcnode_t *qpnode,
 	dns_rdatatype_t rdtype = DNS_TYPEPAIR_TYPE(newheader->typepair);
 	dns_rdatatype_t covers = DNS_TYPEPAIR_COVERS(newheader->typepair);
 	dns_typepair_t sigpair = !dns_rdatatype_issig(rdtype)
-					 ? DNS_SIGTYPE(rdtype)
+					 ? DNS_SIGTYPEPAIR(rdtype)
 					 : dns_typepair_none;
 
 	REQUIRE(rdtype != dns_rdatatype_none);
@@ -2822,7 +2822,7 @@ find_header:
 		    (header->typepair == DNS_TYPEPAIR(dns_rdatatype_a) ||
 		     header->typepair == DNS_TYPEPAIR(dns_rdatatype_aaaa) ||
 		     header->typepair == DNS_TYPEPAIR(dns_rdatatype_ds) ||
-		     header->typepair == DNS_SIGTYPE(dns_rdatatype_ds)) &&
+		     header->typepair == DNS_SIGTYPEPAIR(dns_rdatatype_ds)) &&
 		    EXISTS(header) && EXISTS(newheader) &&
 		    header->trust >= newheader->trust &&
 		    dns_rdataslab_equal(header, newheader))
diff --git a/lib/dns/qpzone.c b/lib/dns/qpzone.c
index 107209dc56..8e6fa99a39 100644
--- a/lib/dns/qpzone.c
+++ b/lib/dns/qpzone.c
@@ -445,7 +445,7 @@ resign_sooner(void *v1, void *v2) {
 	return h1->resign < h2->resign ||
 	       (h1->resign == h2->resign && h1->resign_lsb < h2->resign_lsb) ||
 	       (h1->resign == h2->resign && h1->resign_lsb == h2->resign_lsb &&
-		h2->typepair == DNS_SIGTYPE(dns_rdatatype_soa));
+		h2->typepair == DNS_SIGTYPEPAIR(dns_rdatatype_soa));
 }
 
 /*%
@@ -1646,7 +1646,7 @@ qpzone_findrdataset(dns_db_t *db, dns_dbnode_t *dbnode,
 
 	typepair = DNS_TYPEPAIR_VALUE(type, covers);
 	if (covers == dns_rdatatype_none) {
-		sigpair = DNS_SIGTYPE(type);
+		sigpair = DNS_SIGTYPEPAIR(type);
 	} else {
 		sigpair = dns_typepair_none;
 	}
@@ -3111,7 +3111,7 @@ find_closest_nsec(qpz_search_t *search, dns_dbnode_t **nodep,
 	dns_rdatatype_t matchtype = nsec3 ? dns_rdatatype_nsec3
 					  : dns_rdatatype_nsec;
 	dns_typepair_t typepair = DNS_TYPEPAIR(matchtype);
-	dns_typepair_t sigpair = DNS_SIGTYPE(matchtype);
+	dns_typepair_t sigpair = DNS_SIGTYPEPAIR(matchtype);
 	bool wraps = nsec3;
 	bool first = true;
 	bool need_sig = secure;
@@ -3280,7 +3280,7 @@ qpzone_check_zonecut(qpznode_t *node, void *arg DNS__DB_FLARG) {
 		header_next = header->next;
 		if (header->typepair == dns_rdatatype_ns ||
 		    header->typepair == dns_rdatatype_dname ||
-		    header->typepair == DNS_SIGTYPE(dns_rdatatype_dname))
+		    header->typepair == DNS_SIGTYPEPAIR(dns_rdatatype_dname))
 		{
 			do {
 				if (header->serial <= search->serial &&
@@ -3298,7 +3298,7 @@ qpzone_check_zonecut(qpznode_t *node, void *arg DNS__DB_FLARG) {
 				if (header->typepair == dns_rdatatype_dname) {
 					dname_header = header;
 				} else if (header->typepair ==
-					   DNS_SIGTYPE(dns_rdatatype_dname))
+					   DNS_SIGTYPEPAIR(dns_rdatatype_dname))
 				{
 					sigdname_header = header;
 				} else if (node != search->qpdb->origin ||
@@ -3603,7 +3603,7 @@ found:
 	 * We now go looking for rdata...
 	 */
 
-	sigpair = DNS_SIGTYPE(type);
+	sigpair = DNS_SIGTYPEPAIR(type);
 	empty_node = true;
 	for (header = node->data; header != NULL; header = header_next) {
 		header_next = header->next;
@@ -3707,7 +3707,7 @@ found:
 					if (cnamesig != NULL) {
 						foundsig = cnamesig;
 					} else {
-						sigpair = DNS_SIGTYPE(
+						sigpair = DNS_SIGTYPEPAIR(
 							dns_rdatatype_cname);
 					}
 				}
@@ -3739,7 +3739,8 @@ found:
 				 */
 				nsecheader = header;
 			} else if (header->typepair ==
-					   DNS_SIGTYPE(dns_rdatatype_nsec) &&
+					   DNS_SIGTYPEPAIR(
+						   dns_rdatatype_nsec) &&
 				   !search.version->havensec3)
 			{
 				/*
@@ -3749,7 +3750,7 @@ found:
 				nsecsig = header;
 			} else if (cname_ok &&
 				   header->typepair ==
-					   DNS_SIGTYPE(dns_rdatatype_cname))
+					   DNS_SIGTYPEPAIR(dns_rdatatype_cname))
 			{
 				/*
 				 * If we get a CNAME match, we'll also need